Passed 22 of 24 test cases with the skill, and 19 of 24 without it.
Without skill79%
With skill92%
Checks it passed that the model alone missed
Use the '-X n' flag.
Use the '-C' flag along with the '-d' flag to specify the wordlist.
Embed an attacker-generated public key directly inside the 'jwk' header parameter.
3 fixed19 passed either way2 still failing0 broke
Pass-rate lift
+13 pp
Tokens
+148%
Agent turns
0%
Response time
-1%
Model gemini-3.6-flashMeasured 8/12/2026v122 of 24 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
When conducting automated security testing using the command-line utility `jwt_tool`, which specific attack flag tests for null signature and 'alg:none' bypass vulnerabilities?
What was checked, without and with the skill
Checked
Without skill
With skill
Use the '-X n' flag.
Missed
Passed
case-11 · gemini-3.6-flash · 8/12/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md269 linessingle file
Overview
Comprehensive JWT attack checklist for offensive security engagements. Follow steps in order; apply each technique to the current target context and track which items have been completed.
Quick Reference: Misconfigurations to Check
Algorithm set to none — signature verification bypassed entirely
Algorithm switching between RSA and HMAC (confusion attack)
Weak or guessable HMAC secret (brute-forceable)
kid, jku, jwk, x5u header parameters accepted without validation
Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracin