Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-sess-10
Testing JSON Web Tokens (JWT)
Passed 20 of 25 test cases with the skill, and 17 of 25 without it.
3 fixed17 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
To mitigate replay attacks on stateless authorization tokens, what unique identifier claim should be embedded in the payload during creation, and what function generates it?
| Checked | Without skill | With skill |
|---|---|---|
| The remediation code populates the jti claim using a cryptographically random hex token. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-SESS-10
Testing JSON Web Tokens
JSON Web Tokens (JWT) are widely used for authentication and authorization. Misconfigurations in JWT implementation can lead to authentication bypass, privilege escalation, or information disclosure. This test evaluates the security of JWT generation, validation, and handling.
#!/bin/bash
# Decode JWT token
TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
# Decode header
echo "$TOKEN" | cut -d'.' -f1 | base64 -d 2>/dev/null | jq '.'
test cases passed, vs 17 / 25 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.