What problem does it solve? APIs that rely on JWTs, bearer tokens, API keys, or client-supplied headers often contain trust-boundary flaws that are easy to miss during manual review. This Skill provides a structured playbook for systematically probing token validation, claim trust, header spoofing, and rate-limit enforcement during authorized security assessments. ## Core Features & Use Cases - Token Triage: Inspect JWT headers and claims such as alg, kid, jku, x5u, role, scope, issuer, and audience for trust and mismatch issues. - Attack Pattern Table: Quick-reference tests for alg:none acceptance, RS256-to-HS256 confusion, kid injection, attacker-controlled jku/x5u, and weak secret cracking. - Mass Assignment & Rate-Limit Bypass: Candidate hidden fields (role, isAdmin, plan, permissions) and header families (X-Forwarded-For, X-Real-IP, Forwarded) for bypassing rate limits and abusing batch requests. - Use Case: During a web CTF or authorized pentest, you receive a JWT from a login endpoint. Use this Skill to check whether the server accepts alg:none tokens, trusts a manipulated kid parameter, or lets you bypass login rate limits with X-Forwarded-For rotation. ## Quick Start Ask the agent to analyze the JWT from the target login response and test it for algorithm confusion, kid injection, and rate-limit bypass using the api-auth-and-jwt-abuse playbook.
