Find exploitable weaknesses in token trust and OAuth flows.
What it does
Guides testing of JWT trust, signing, key handling, claims, bearer flows, and OAuth account binding.
When to use it
Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, or OAuth account binding.
How to use it
It changes how the agent tests token-centric attacks and OAuth flow abuse.
Latest review
What you need · 3
Routes redirect URI, state, nonce, PKCE, and account-binding validation to this skill.
Routes cross-origin browser-readable API and token-leakage testing to this skill when applicable.
Access · 4
This skill
target web application
Write
Tests crafted authentication requests
attacker.com
Write
Hosts a malicious JWKS