Loading…
Exploits JWT algorithm confusion where the server's verification library trusts the alg named in the token header, by switching RS256 to HS256 (signing with the RSA public key as HMAC secret), setting alg to none, or injecting kid/jku/x5u headers to supply an attacker-controlled key. Use when testing RS256 JWT auth for algorithm downgrade, alg:none bypass, or key-confusion signature forgery.
exploiting-jwt-algorithm-confusion-attack is an agent skill entry in ChatHome Skills, sourced from GitHub Skill Search and scored 58/100. # Exploiting JWT Algorithm Confusion Attack ## When to Use - Testing APIs that use RS256 (asymmetric) JWT tokens for authentication to check for algorithm downg. As an agent skill, it packages a reusable instruction set that AI coding agents such as Codex and Claude Code can load to perform this task without hand-written glue code. ChatHome Skills discovered this entry through its daily ingest of official registries and GitHub discovery queries, and re-verifies repository facts, freshness signals, and install metadata on every run. The quality score weighs official-registry presence, a working install command, license clarity, GitHub star trajectory, and repository freshness — the full formula is on the Sources page. The install command above is ready to copy. Review the last-pushed date and repository status before adding exploiting-jwt-algorithm-confusion-attack to a production agent workflow; the snapshot facts below are point-in-time values from the most recent ingest.
codex skill install lewiseinstein15-Tech/jexi-os-Review the upstream source before running this command.
Scan coverage: Install metadata and the indexed document body.
Automated signals from install metadata and a bounded skill body — not a full code security audit and not a recursive source or dependency review.
# Exploiting JWT Algorithm Confusion Attack ## When to Use - Testing APIs that use RS256 (asymmetric) JWT tokens for authentication to check for algorithm downgrade to HS256 - Asse