# jwt-security-review

Audits JWT implementations for key confusion, weak secrets, and token lifecycle flaws. Handy when checking API authorization code.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1500 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/web-appsec/auth/jwt-security-review/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/jwt-security-review

## What it does

This skill guides your coding agent through an end-to-end inspection of token verification logic. The assistant flags critical issues like RS256 to HS256 algorithm confusion, header injections via `kid` or `jku`, and missed signature checks where code calls `jwt.decode` instead of verification functions.

Token lifecycles undergo strict scrutiny. The review checks whether access tokens expire within 15 minutes, refresh tokens detect replay attempts, and storage avoids `localStorage` whenever XSS exposure exists. Any HS256 secret with entropy below 32 bytes breaks security baselines immediately.

Every finding includes redacted token payloads, affected file paths, and explicit remediation steps.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill jwt-security-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/jwt-security-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/jwt-security-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill jwt-security-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/jwt-security-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill jwt-security-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/jwt-security-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills jwt-security-review
```

2. **Manually: put the files in place**
- File: `.github/skills/jwt-security-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill jwt-security-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path web-appsec/auth/jwt-security-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/jwt-security-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill jwt-security-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/web-appsec/auth/jwt-security-review/SKILL.md

## When to use it
- detect RS256 to HS256 key confusion in verification logic
- verify that exp, iss, and aud claims are strictly enforced
- identify refresh token reuse flaws during session rotation
- spot insecure token persistence inside localStorage

## Example prompts
- Run a JWT security audit on our auth controller in server/auth.ts
- Check our token validation middleware for algorithm confusion and kid injection vulnerabilities
- Review how we handle refresh token rotation and token expiration in the API

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [securityskills/skills](https://affpapa.org/en/nevibecode/by/securityskills/skills.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md