Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →asdfgh1445/Strix•JWT 身份认证测试
Strix JWT 与 OIDC 安全测试手册,覆盖令牌伪造、算法混淆与声明篡改;触发名:strix-authentication-jwt
Passed 21 of 22 test cases with the skill, and 19 of 22 without it.
2 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
An API receives a JWT whose header is missing the `kid` parameter or containing an unknown `kid`. A developer claims the API will throw a key missing exception and reject the request. What implementation bug in key lookup handling allows signature validation to succeed despite an invalid `kid`?
| Checked | Without skill | With skill |
|---|---|---|
| Iterating and trying all available public keys in the JWKS until one successfully verifies the signature. | Missed | Passed |
The instructions your model reads when the skill loads.
JWT/OIDC failures often enable token forgery, token confusion, cross-service acceptance, and durable account takeover. Do not trust headers, claims, or token opacity without strict validation bound to issuer, audience, key, and context.
/.well-known/openid-configuration, /oauth2/.well-known/openid-configuration/jwks.json, rotating key endpoints, tenant-specific JWKS/authorize, /token, /introspect, /revoke, /logout, device code endpoints/login, /callback, /refresh, /me, /session, /impersonate{"alg":"RS256","kid":"...","typ":"JWT","jku":"...","x5u":"...","jwk":{...}}{"iss":"...","aud":"...","azp":"...","sub":"user","scope":"...","exp":...,"nbf":...,"iat":...}"b64":false) and critical headers ("crit")"alg":"none" and drop the signature if libraries accept it../../../../keys/prod.key, SQL/command/template injection in key lookup, or pointing to world-readable filestest cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.