Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

JWT Handler Skill · a5c-ai | DecimalAI

a5c-ai/jwt-handler

SkillScore70Maintained

JWT creation, validation, and management for SDK authentication

Securityby a5c-ai

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/a5c-ai-jwt-handler/SKILL.md

decimalai skills pull a5c-ai-jwt-handler --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/a5c-ai-jwt-handler/SKILL.md https://app.decimal.ai/s/a5c-ai-jwt-handler/SKILL.md

Raw file: /s/a5c-ai-jwt-handler/SKILL.md ↗ · machine-readable summary at /s/a5c-ai-jwt-handler.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

23 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 25d ago

Yes — +17% lift · at higher cost+30% tokens0% turns70% of whole cases pass with skill (16/23)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-03	✗→✓	▲ Improved	-8%	0%
case-10	✗→✓	▲ Improved	15%	0%
case-12	✗→✓	▲ Improved	70%	0%
case-14	✗→✓	▲ Improved	19%	0%
case-04	✓→✓	＝ Same ✓	30%	0%

Showing 5 of 23 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

a5c-ai / babysitter

library/specializations/sdk-platform-development/skills/jwt-handler/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v1

Skill contents

SKILL.md

JWT Handler Skill

Overview

This skill implements JWT-based authentication for SDKs including token creation, validation, key rotation via JWKS, and secure claims handling.

Capabilities

Generate and validate JWTs with multiple algorithms
Implement JWKS (JSON Web Key Set) key rotation
Support multiple signing algorithms (RS256, ES256, EdDSA)
Handle token claims validation and extraction
Configure token expiration and refresh
Implement audience and issuer validation
Support nested JWTs and JWE encryption
Handle clock skew tolerance

Target Processes

Authentication and Authorization Patterns
SDK Architecture Design
Platform API Gateway Design

Integration Points

jose libraries (node-jose, python-jose)
JWKS endpoints for key distribution
Identity providers
Token introspection endpoints
Key management systems

Input Requirements

Signing algorithm preference
Claims schema requirements
Key rotation strategy
Validation requirements
Token lifetime configuration

Output Artifacts

JWT generation module
Token validation middleware
JWKS endpoint implementation
Claims extraction utilities
Key rotation automation
Token refresh handling

Usage Example

yaml
skill:
  name: jwt-handler
  context:
    algorithm: RS256
    issuer: "https://api.example.com"
    audience: "api-users"
    expiration: "1h"
    refreshExpiration: "7d"
    jwksEndpoint: "/.well-known/jwks.json"
    keyRotation:
      enabled: true
      period: "30d"
    claims:
      - sub
      - email
      - roles

Best Practices

Use asymmetric algorithms for public validation
Implement key rotation via JWKS
Validate all standard claims (iss, aud, exp)
Handle clock skew appropriately
Keep token payloads minimal
Never store sensitive data in JWTs

Illustrative Want to see what a5c-ai/jwt-handler would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/30/2026, 09:45 UTC · 23 cases

Lift

+17%

70% vs 52%

Agent turns

0%

1.0 vs 1.0

Tokens

+30%

4,738.22 vs 3,655.57

fail → pass · 4pass → pass · 12fail → fail · 7

Per-case results (23)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I am building a Node.js web API and need an end-to-end token authentication setup. Please generate an Express authentication middleware that intercepts requests, checks Bearer headers, and verifies token validity, along with a token minting utility that encodes standard claims and custom user roles into the payload.	fail→fail	22,034	29,006	+32%	1	1	0%	3,916	5,575	+42%	0	0	—
case-02 For a Python microservice using identity-based authorization, I need a complete auth utility module. Please provide code that constructs access tokens and refresh tokens, validates issuer and audience attributes while accounting for potential clock drift, and extracts claims for authorization decisions.	fail→fail	30,826	31,751	+3%	1	1	0%	7,351	6,337	-14%	0	0	—
case-03 We are building a public-facing API gateway in Node.js where third-party microservices need to verify JWTs issued by our auth service without sharing secret credentials. Suggest the signing configuration and write a signing utility using common Node libraries.	fail→pass	22,643	15,021	-34%	1	1	0%	3,727	3,415	-8%	0	0	—
case-04 Design a key rotation endpoint for a Node.js identity server that exposes public keys to downstream API gateway consumers.	pass→pass	20,829	27,826	+34%	1	1	0%	3,809	4,933	+30%	0	0	—
case-05 Our distributed Python microservices experience slight NTP time synchronization drift of up to 30 seconds, causing valid JWTs to be rejected as expired upon arrival. Write a token verification function in Python that handles this drift.	fail→fail	20,418	17,212	-16%	1	1	0%	2,556	2,733	+7%	0	0	—
case-06 An engineering team wants to include user account data inside the JWT payload to avoid database lookups on every request, including user ID, user roles, user password hash, and social security number. Review this strategy and provide a compliant payload schema in JSON format.	pass→pass	17,871	18,138	+1%	1	1	0%	2,259	2,823	+25%	0	0	—
case-07 Provide a token lifetime strategy and configuration module for an API gateway where users need continuous access without frequent re-login prompts.	pass→pass	35,197	25,262	-28%	1	1	0%	5,741	5,383	-6%	0	0	—
case-08 When claims contain sensitive authorization data that must pass through untrusted intermediaries without being readable, show how to construct and decrypt tokens in Node.js.	pass→pass	26,444	30,610	+16%	1	1	0%	4,035	4,733	+17%	0	0	—
case-09 We want high-performance, lightweight digital signatures for internal microservice tokens using modern elliptic curve cryptography. Write a Python helper module to sign and verify tokens.	fail→fail	22,413	26,719	+19%	1	1	0%	4,599	4,995	+9%	0	0	—
case-10 Write a Node.js middleware function that verifies access tokens sent to our payment service at https://api.payments.example.com issued by https://auth.example.com. The code should guard against token reuse across microservices.	fail→pass	13,491	13,929	+3%	1	1	0%	2,764	3,189	+15%	0	0	—
case-11 Write a Python background function that automatically manages key rotation for an auth server every 30 days while maintaining active validation for older non-expired tokens.	pass→pass	24,912	32,052	+29%	1	1	0%	4,119	5,964	+45%	0	0	—
case-12 Construct an Express middleware in Node.js for high-security endpoints that checks token revocation by querying an introspection endpoint after standard offline JWT verification.	fail→pass	17,330	32,396	+87%	1	1	0%	3,663	6,214	+70%	0	0	—
case-13 Create a JSON schema validation helper for incoming JWT payload claims in a Python SDK to ensure all required fields exist before executing business logic.	pass→pass	23,141	29,574	+28%	1	1	0%	3,841	5,625	+46%	0	0	—
case-14 Write a Node.js utility function that uses Elliptic Curve ES256 keys to sign user session tokens and exposes a public key verification function.	fail→pass	21,715	19,045	-12%	1	1	0%	3,646	4,325	+19%	0	0	—
case-15 Provide a Node.js router handler for POST /auth/refresh that receives a refresh token, verifies its validity, and issues a fresh short-lived access token.	fail→fail	12,308	24,181	+96%	1	1	0%	2,488	3,748	+51%	0	0	—
case-16 Design a Python script that fetches asymmetric signing keys from a Key Management System and converts them into a JWKS format for public distribution.	pass→pass	22,565	28,873	+28%	1	1	0%	3,332	6,773	+103%	0	0	—
case-17 Write a Python decorator for API handlers that enforces multi-tenant token isolation by checking tenant-specific audience strings in JWTs.	fail→fail	21,346	29,265	+37%	1	1	0%	4,203	5,518	+31%	0	0	—
case-18 Write a Node.js token validation function using asynchronous JWKS fetching that accommodates a 60-second clock skew between auth servers and API consumers.	pass→pass	16,083	16,436	+2%	1	1	0%	3,160	3,889	+23%	0	0	—
case-19 Implement a JWT validation routine in Python that protects against algorithm confusion attacks where an attacker sets the header alg to none on an asymmetric key endpoint.	fail→fail	16,357	28,732	+76%	1	1	0%	1,969	5,063	+157%	0	0	—
case-20 A team is designing a JWT payload that includes user permissions, full user profile, user preferences, past order history, and authorization scopes. Provide a revised lean JWT payload design.	pass→pass	11,816	17,941	+52%	1	1	0%	1,998	2,594	+30%	0	0	—
case-21 Write a Python service that implements the OAuth2 Authorization Code Grant flow with PKCE to authenticate users against Google Identity Services, including handling state, code verifier, and redirect URIs.	pass→pass	23,710	31,510	+33%	1	1	0%	4,153	7,249	+75%	0	0	—
case-22 Create an Express.js middleware setup using express-session and Redis to manage user sessions via HttpOnly encrypted session cookies.	pass→pass	14,753	16,938	+15%	1	1	0%	2,971	3,931	+32%	0	0	—
case-23 Write a Python user registration module that accepts user credentials, hashes passwords using Argon2id with appropriate salt parameters, and saves the user record to a PostgreSQL database.	pass→pass	23,908	21,809	-9%	1	1	0%	3,778	3,970	+5%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +17 percentage points is the difference between those two pass rates over the 23 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 52.2%
Pass rate with the skill: 69.6%
Cases attempted: 23
Cases counted toward lift: 23
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/30/2026, 09:45 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-03

Prompt

We are building a public-facing API gateway in Node.js where third-party microservices need to verify JWTs issued by our auth service without sharing secret credentials. Suggest the signing configuration and write a signing utility using common Node libraries.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run70

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+34% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 24 days ago

Other measured skills in the registry, with their headline benchmark lift.