Articles tagged "JWT" - Yeyupiaoling

攻击性JWT：为 Agent 准备的 JWT 攻防向 Skill

2026-10-21 Big Model Skills JWT SkillHub AI Agent it-ops-security security testing

攻击性JWT是 SkillHub 社区技能 @user_3c6cb52e/offensive-jwt-lr-trtm（v1.0.0，it-ops-security），以 SKILL.md 帮助 Agent 处理 JWT 攻防相关任务，无需 API Key。本文依据官方页面与安装文档说明定位、安装命令（skillhub install 与各客户端 skills 目录）、页面推荐的 Agent 安装提示词，以及授权测试场景下的对话用法；能力细节以本地 SKILL.md 为准。

JWT/OAuth令牌攻击：为 Agent 准备的令牌安全测试技能

2026-10-21 Big Model Skills SkillHub JWT OAuth security testing AI Agent

SkillHub 社区技能 JWT/OAuth令牌攻击（@user_3c6cb52e/jwt-oauth-token-attacks-lr-0xh6，v1.0.0，it-ops-security）面向 AI Agent，聚焦 JWT 与 OAuth 令牌相关安全任务，requires_api_key=false。文章说明其定位、已公开的元数据能力边界，并给出按 skillhub.cn/install/skillhub.md 安装 CLI、用 skillhub install 与 --dir 装入 Cursor/Claude Code/Codex 等 skills 目录的步骤。典型用法为加载 SKILL.md 后在授权范围内执行任务；强调合法授权与以本地技能正文为准。

dsh-jwt-uckkk: JWT Decoding and Expiration Check

2026-09-21 DeepSeek Harness plugin DeepSeek DSH JWT dsh-jwt-uckkk debugging tool

DSH Harness provides the `dsh-jwt-uckkk` plugin for quickly decoding and inspecting externally provided JWT tokens. Implemented in Node.js, the plugin is intended only for viewing the header, payload, and expiration, and does not perform signature validation, making it suitable for debugging scenarios. Users need to install the plugin via the CLI and enable it in the Profile configuration, after which they can call the `jwt_decode` method to parse the token. Note that the plugin runs with the current process’s permissions. Please review its source code and license before use, and use it only for data inspection; do not directly trust token integrity in production environments.

dsh-tool-jwt: DeepSeek Harness JWT Tool Plugin

2026-09-16 DeepSeek Harness plugin DeepSeek DSH JWT Plugin tool

The DSH ecosystem plugin `dsh-tool-jwt` is designed to address the inefficiency and error-proneness of JWT parsing, issuance, and verification in intelligent agent development. Built on Node.js built-in modules, it provides three core capabilities: parsing without signature verification, token issuance, and full verification, including algorithm checks, timing-attack resistance, and expiration validation. The plugin can be installed via a Profile Bundle and enforces a strict security model with input constraints, making it suitable for development and integration testing scenarios.