Api Auth And Jwt Abuse

Name: Api Auth And Jwt Abuse
Author: yaklang

yaklang/hack-skills

2.4k installs
1.5k repo stars
Updated June 16, 2026
yaklang/hack-skills

api-auth-and-jwt-abuse is an agent skill that >-.

About

SKILL API Auth and JWT Abuse Token Trust Header Tricks and Rate Limits AI LOAD INSTRUCTION Use this skill when APIs rely on JWT bearer tokens API keys or weak request identity signals Focus on token trust boundaries claim misuse header spoofing and rate limit bypass alg kid jku x5u role org tenant scope or privilege claims issuer and audience mismatches reuse of mobile and web tokens across products Pattern First Test alg none acceptance unsigned token with trailing dot RS256 confusion switch to HS256 using public key as secret kid lookup trust path traversal or injection in kid remote key fetch trust attacker controlled jku or x5u weak secret offline crack with targeted wordlists text role isAdmin admin verified plan tier permissions org owner The api auth and jwt abuse agent skill provides documented workflows prerequisites triggers and safety guidance from its SKILL md source Agents load it when user requests match the description and follow step by step instructions without inventing capabilities It integrates with standard agent tooling

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate
> **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signa
- role, org, tenant, scope, or privilege claims
Follow api-auth-and-jwt-abuse SKILL.md steps and documented constraints.
Follow api-auth-and-jwt-abuse SKILL.md steps and documented constraints.

Api Auth And Jwt Abuse by the numbers

2,400 all-time installs (skills.sh)
+134 installs in the week ending Aug 5, 2026 (Skillselion tracking)
Ranked #387 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
Security screen: CRITICAL risk (skills.sh audit)
Data as of Aug 5, 2026 (Skillselion catalog sync)

At a glance

api-auth-and-jwt-abuse capabilities & compatibility

Capabilities: api authentication and jwt abuse playbook. use w · > **ai load instruction**: use this skill when a · role, org, tenant, scope, or privilege claims · follow api auth and jwt abuse skill.md steps and
Use cases: orchestration

From the docs

What api-auth-and-jwt-abuse says it does

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

SKILL.md

> **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-lim

SKILL.md

- role, org, tenant, scope, or privilege claims

SKILL.md

npx skills add https://github.com/yaklang/hack-skills --skill api-auth-and-jwt-abuse

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/yaklang/hack-skills/api-auth-and-jwt-abuse.svg)](https://skillselion.com/skills/yaklang/hack-skills/api-auth-and-jwt-abuse)

Installs	2.4k
repo stars	★ 1.5k
Security audit	1 / 3 scanners passed
Last updated	June 16, 2026
Repository	yaklang/hack-skills ↗

When should an agent use api-auth-and-jwt-abuse and what problem does it solve?

Who is it for?

Developers invoking api-auth-and-jwt-abuse as documented in the skill source.

Skip if: Skip when requirements fall outside api-auth-and-jwt-abuse documented scope.

When should I use this skill?

What you get

Outputs aligned with the api-auth-and-jwt-abuse SKILL.md workflow and stated deliverables.

Token triage report
Auth abuse test cases
Rate-limit and header spoof findings

By the numbers

Covers JWT header fields alg, kid, jku, and x5u in token triage
Tests role, org, tenant, scope, issuer, and audience claim misuse paths

Files

SKILL.mdMarkdownGitHub ↗

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits

AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.

1. TOKEN TRIAGE

Inspect:

alg, kid, jku, x5u
role, org, tenant, scope, or privilege claims
issuer and audience mismatches
reuse of mobile and web tokens across products

2. QUICK ATTACK PICKS

Pattern	First Test
`alg:none` acceptance	unsigned token with trailing dot
RS256 confusion	switch to HS256 using public key as secret
`kid` lookup trust	path traversal or injection in `kid`
remote key fetch trust	attacker-controlled `jku` or `x5u`
weak secret	offline crack with targeted wordlists

3. HIDDEN FIELDS AND BATCH ABUSE

Mass assignment field picks

role
isAdmin
admin
verified
plan
tier
permissions
org
owner

Rate limit and batch abuse picks

X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9

GraphQL or JSON batch abuse candidates:

arrays of login mutations
bulk object fetches with varying IDs
repeated password reset or verification calls in one request

4. RATE LIMIT BYPASS FAMILIES

X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants

5. NEXT ROUTING

For GraphQL batching and hidden parameters: graphql and hidden parameters
For default credential and brute-force planning: authentication bypass
For full JWT and OAuth depth: jwt oauth token attacks
For OAuth or OIDC configuration flaws in browser and SSO flows: oauth oidc misconfiguration
For credentialed browser reads and origin trust bugs: cors cross origin misconfiguration