jwt-security-review — Claude Code skill: what it does, how to install
Audits JWT implementations for key confusion, weak secrets, and token lifecycle flaws. Handy when checking API authorization code.
npx skills add securityskills/skills --skill jwt-security-review -a claude-codeWhat jwt-security-review does
This skill guides your coding agent through an end-to-end inspection of token verification logic. The assistant flags critical issues like RS256 to HS256 algorithm confusion, header injections via kid or jku, and missed signature checks where code calls jwt.decode instead of verification functions.
Token lifecycles undergo strict scrutiny. The review checks whether access tokens expire within 15 minutes, refresh tokens detect replay attempts, and storage avoids localStorage whenever XSS exposure exists. Any HS256 secret with entropy below 32 bytes breaks security baselines immediately.
Every finding includes redacted token payloads, affected file paths, and explicit remediation steps.
What it helps with
- detect RS256 to HS256 key confusion in verification logic
- verify that exp, iss, and aud claims are strictly enforced
- identify refresh token reuse flaws during session rotation
- spot insecure token persistence inside localStorage
Example prompts for the agent
- Run a JWT security audit on our auth controller in server/auth.ts
- Check our token validation middleware for algorithm confusion and kid injection vulnerabilities
- Review how we handle refresh token rotation and token expiration in the API
How to install jwt-security-review
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill jwt-security-review -a claude-code2Manually: put the files in place
~/.claude/skills/jwt-security-review/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/jwt-security-review/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill jwt-security-review -a codex2Manually: put the files in place
.agents/skills/jwt-security-review/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add securityskills/skills --skill jwt-security-review -a cursor2Manually: put the files in place
.cursor/skills/jwt-security-review/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install securityskills/skills jwt-security-review2Manually: put the files in place
.github/skills/jwt-security-review/SKILL.md1Skills CLI (Vercel)
npx skills add securityskills/skills --skill jwt-security-review -a gemini-cli2Platform CLI
gemini skills install https://github.com/securityskills/skills --path web-appsec/auth/jwt-security-reviewManually: put the files in place
.devin/skills/jwt-security-review/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add securityskills/skills --skill jwt-security-review -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about jwt-security-review
How do I install jwt-security-review in Claude Code?
Run npx skills add securityskills/skills --skill jwt-security-review -a claude-code. The file will be saved to ~/.claude/skills/jwt-security-review/SKILL.md.
What does jwt-security-review do?
It directs your agent to inspect authentication logic, looking for weak HMAC secrets, unpinned algorithms, and improper session lifecycle handling.
Which test cases does this skill evaluate?
The agent reviews scenarios like rejecting alg: none, swapping public keys into HS256 signatures, using expired timestamps, and replaying invalidated refresh tokens.
