How do I install the API Auth And JWT Abuse skill?

Run npx skillmds add shulkwisec/api-auth-and-jwt-abuse in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is API Auth And JWT Abuse safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with API Auth And JWT Abuse?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is API Auth And JWT Abuse free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published API Auth And JWT Abuse?

ShulkwiSEC (@shulkwisec) published this skill. Their other Agent Skills are listed on their SkillMD profile.

API Auth And JWT Abuse by shulkwisec

Name: API Auth And JWT Abuse
Rating: 4.2 (5 reviews)
Author: ShulkwiSEC

File contents

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits

AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.

1. TOKEN TRIAGE

Inspect:

alg, kid, jku, x5u
role, org, tenant, scope, or privilege claims
issuer and audience mismatches
reuse of mobile and web tokens across products

2. QUICK ATTACK PICKS

Pattern	First Test
`alg:none` acceptance	unsigned token with trailing dot
RS256 confusion	switch to HS256 using public key as secret
`kid` lookup trust	path traversal or injection in `kid`
remote key fetch trust	attacker-controlled `jku` or `x5u`
weak secret	offline crack with targeted wordlists

3. HIDDEN FIELDS AND BATCH ABUSE

Mass assignment field picks

role
isAdmin
admin
verified
plan
tier
permissions
org
owner

Rate limit and batch abuse picks

X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9

GraphQL or JSON batch abuse candidates:

arrays of login mutations
bulk object fetches with varying IDs
repeated password reset or verification calls in one request

4. RATE LIMIT BYPASS FAMILIES

X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants

5. NEXT ROUTING

For GraphQL batching and hidden parameters: graphql and hidden parameters
For default credential and brute-force planning: authentication bypass
For full JWT and OAuth depth: jwt oauth token attacks
For OAuth or OIDC configuration flaws in browser and SSO flows: oauth oidc misconfiguration
For credentialed browser reads and origin trust bugs: cors cross origin misconfiguration

---name: api-auth-and-jwt-abusedescription: API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.---# SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits> **AI LOAD INSTRUCTION**: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.## 1. TOKEN TRIAGEInspect:- `alg`, `kid`, `jku`, `x5u`- role, org, tenant, scope, or privilege claims- issuer and audience mismatches- reuse of mobile and web tokens across products## 2. QUICK ATTACK PICKS| Pattern | First Test ||---|---|| `alg:none` acceptance | unsigned token with trailing dot || RS256 confusion | switch to HS256 using public key as secret || `kid` lookup trust | path traversal or injection in `kid` || remote key fetch trust | attacker-controlled `jku` or `x5u` || weak secret | offline crack with targeted wordlists |## 3. HIDDEN FIELDS AND BATCH ABUSE### Mass assignment field picks```textroleisAdminadminverifiedplantierpermissionsorgowner```### Rate limit and batch abuse picks```textX-Forwarded-For: 1.2.3.4X-Real-IP: 5.6.7.8Forwarded: for=9.9.9.9```GraphQL or JSON batch abuse candidates:- arrays of login mutations- bulk object fetches with varying IDs- repeated password reset or verification calls in one request## 4. RATE LIMIT BYPASS FAMILIES```textX-Forwarded-ForX-Real-IPForwardedUser-Agent rotationPath case / slash variants```## 5. NEXT ROUTING- For GraphQL batching and hidden parameters: [graphql and hidden parameters](../graphql-and-hidden-parameters/SKILL.md)- For default credential and brute-force planning: [authentication bypass](../authbypass-authentication-flaws/SKILL.md)- For full JWT and OAuth depth: [jwt oauth token attacks](../jwt-oauth-token-attacks/SKILL.md)- For OAuth or OIDC configuration flaws in browser and SSO flows: [oauth oidc misconfiguration](../oauth-oidc-misconfiguration/SKILL.md)- For credentialed browser reads and origin trust bugs: [cors cross origin misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md)

Frequently asked questions