haryy985/yunkun-console-preview/api-auth-and-jwt-abuse

Claude Code and agent skill by haryy985/yunkun-console-preview

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

Install

npx vskill@latest install haryy985/yunkun-console-preview/api-auth-and-jwt-abuse

SKILL.md

SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits

AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.

1. TOKEN TRIAGE

Inspect:

  • alg, kid, jku, x5u
  • role, org, tenant, scope, or privilege claims
  • issuer and audience mismatches
  • reuse of mobile and web tokens across products

2. QUICK ATTACK PICKS

PatternFirst Test
alg:none acceptanceunsigned token with trailing dot
RS256 confusionswitch to HS256 using public key as secret
kid lookup trustpath traversal or injection in kid
remote key fetch trustattacker-controlled jku or x5u
weak secretoffline crack with targeted wordlists

3. HIDDEN FIELDS AND BATCH ABUSE

Mass assignment field picks
text
role
isAdmin
admin
verified
plan
tier
permissions
org
owner
Rate limit and batch abuse picks
text
X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9

GraphQL or JSON batch abuse candidates:

  • arrays of login mutations
  • bulk object fetches with varying IDs
  • repeated password reset or verification calls in one request

4. RATE LIMIT BYPASS FAMILIES

text
X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants

5. NEXT ROUTING

  • For GraphQL batching and hidden parameters: ../../../skills/skill/knowledge-base/graphql-test.md
  • For default credential and brute-force planning: ../../../skills/skill/knowledge-base/authbypass-test.md
  • For full JWT and OAuth depth: ../../../skills/skill/knowledge-base/oauth-jwt-test.md
  • For OAuth or OIDC configuration flaws in browser and SSO flows: ../../../skills/skill/knowledge-base/oauth-jwt-test.md
  • For credentialed browser reads and origin trust bugs: ../../../skills/skill/knowledge-base/cors-test.md

Security

  • Security scanPassed, 90 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

7-day trend score
0

Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/haryy985/yunkun-console-preview/api-auth-and-jwt-abuse/badge)](https://verified-skill.com/skills/haryy985/yunkun-console-preview/api-auth-and-jwt-abuse)

Something wrong with this skill or its page? Tell us.