Audit token validation
Skill danygiguere/audit-skills/.agents/skills/audit-token-validation
Inbound token and webhook verification checklist. Use when code verifies JWTs, API keys, signed URLs, or webhook signatures — decode-without-verify, alg confusion, missing exp/aud/iss checks, kid/JWKS handling, HMAC over raw body, replay windows.From its SKILL.md
npx -y skills add danygiguere/audit-skills --skill audit-token-validationAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 5 stars5 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
0.6 KB, 65 tokens by cl100k_base, as published. Nobody here has run it
Read ../audit/references/access-data-security/token-validation.md and apply its checklist to the code the
user specified (or the current diff if none was given). Verify each candidate
with ../audit/references/methodology/verify.md before reporting. Report findings with severity and
file:line references.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.