api-auth-and-jwt-abuse

api auth and jwt abuse

yaklang 1.4k ↓ 2.1k MIT updated 2mo ago

Claude Code

View source ↗

What it does

alg, kid, jku, x5u
role, org, tenant, scope, or privilege claims
issuer and audience mismatches
reuse of mobile and web tokens across products
arrays of login mutations
bulk object fetches with varying IDs
repeated password reset or verification calls in one request

Requirements & configuration

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits
1. TOKEN TRIAGE
| alg:none acceptance | unsigned token with trailing dot |
For full JWT and OAuth depth: jwt oauth token attacks

Derived from the skill's own SKILL.md documentation · extracted 2026-07-23

api auth and jwt abuse

Source

Repository: https://github.com/yaklang/hack-skills

api-auth-and-jwt-abuse FAQ

What does the api-auth-and-jwt-abuse skill do?

>- API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses. alg, kid, jku, x5u role, org, tenant, scope, or privilege claims

What does api-auth-and-jwt-abuse require?

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits 1. TOKEN TRIAGE | alg:none acceptance | unsigned token with trailing dot | For full JWT and OAuth depth: jwt oauth token attacks

How do I install api-auth-and-jwt-abuse?

Run: npx -y skills add https://github.com/yaklang/hack-skills --skill api-auth-and-jwt-abuse --agent claude-code — the source lives at github.com/yaklang/hack-skills.

Maintain api-auth-and-jwt-abuse?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[api-auth-and-jwt-abuse on getagentictools](https://getagentictools.com/skills/yaklang-hack-skills-api-auth-and-jwt-abuse?ref=badge)

npx agentictools info skills/yaklang-hack-skills-api-auth-and-jwt-abuse

The second line is the CLI lookup for this page — handy in READMEs and docs.