Skip to content
Get packs

JWT Claim Confusion Analysis

Guides an agent through JWT header, key, and claim checks to find token-to-identity confusion bugs in CTF sandboxes

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill gives an AI agent a structured checklist for analysing how a JSON Web Token (a signed login token used by many websites and APIs) is parsed, which signing key is chosen, and which claims such as subject, audience, issuer or role are trusted to grant access. It is written for capture-the-flag (CTF) training sandboxes and is meant to run only after a separate orchestrator skill has set up sandbox assumptions. The agent records token headers and claims, traces how they become an accepted identity, and reproduces a minimal token-to-acceptance flow.

Great for

  • Students practising CTF or web security challenges in a lab sandbox
  • Security engineers reviewing JWT validation logic in systems they are authorised to test
  • Developers checking that their own JWT audience, issuer and key handling is correct

Skip it if

  • Testing live or third-party systems without written authorisation, since it is built to find and reproduce authentication bypasses and could be misused against real services
  • Simple JWT decoding or general token questions, where a lighter tool is enough
  • Use without the companion ctf-sandbox-orchestrator skill, because the file itself says it should not be used standalone

Try asking

  • “Inspect this JWT header and claims and tell me which key the server would select for verification”
  • “Explain how the role claim in this token becomes admin access in the sandbox app”
  • “Check whether the audience and issuer checks in this validation code could be confused”
  • “Reproduce the smallest token flow that shows the alg or kid handling bug in this challenge”
Step-by-step guide: how to use JWT Claim Confusion AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-jwt-claim-confusion.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-jwt-claim-confusion.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-jwt-claim-confusion.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Set up the ctf-sandbox-orchestrator skill first, since this one is a downstream specialisation and says so explicitly
  • Only point it at sandbox or lab targets you own or are permitted to test
  • Ask for the minimal reproducible sequence rather than broad exploitation, to keep evidence clear

What's inside

  • agents/openai.yaml
  • references/jwt-claim-confusion.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.