SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits
SkillSecurityYour AI can help you find weak spots in how an API checks that callers are who they claim to be. This skill is a step-by-step playbook for testing API authentication and token abuse, so you get a structured pass over the areas attackers tend to probe instead of guessing where to look. It covers bearer tokens, API keys, the claims inside tokens, spoofed headers, rate limits, and authentication boundary weaknesses.
Available today. Use it from your connected AI after setup.
No other account needed.
After adding the skill, tell your AI which part of an API's authentication you want to test, such as its tokens, keys, or rate limits. Your AI will follow the playbook to run the checks that apply.
Then ask your AI: use the SKILL: API Auth and JWT Abuse — Token Trust, Header Tricks, and Rate Limits skill
What your AI can do with it
- Test bearer tokens for weaknesses
- Check API keys for flaws
- Spot token claims that get trusted without proper verification
- Test defenses against spoofed headers
- Probe rate limits for gaps
- Find weak points in API authentication boundaries
What this skill tells your AI
The instructions your AI receives, as published by zyrexnn/cybermes in skills/api-auth-and-jwt-abuse/SKILL.md and read by ahel’s review.
AI LOAD INSTRUCTION: Use this skill when APIs rely on JWT, bearer tokens, API keys, or weak request identity signals. Focus on token trust boundaries, claim misuse, header spoofing, and rate-limit bypass.
1. TOKEN TRIAGE
Inspect:
alg,kid,jku,x5u- role, org, tenant, scope, or privilege claims
- issuer and audience mismatches
- reuse of mobile and web tokens across products
2. QUICK ATTACK PICKS
| Pattern | First Test |
|---|---|
alg:none acceptance | unsigned token with trailing dot |
| RS256 confusion | switch to HS256 using public key as secret |
kid lookup trust | path traversal or injection in kid |
| remote key fetch trust | attacker-controlled jku or x5u |
| weak secret | offline crack with targeted wordlists |
3. HIDDEN FIELDS AND BATCH ABUSE
Mass assignment field picks
role
isAdmin
admin
verified
plan
tier
permissions
org
owner
Rate limit and batch abuse picks
X-Forwarded-For: 1.2.3.4
X-Real-IP: 5.6.7.8
Forwarded: for=9.9.9.9
GraphQL or JSON batch abuse candidates:
- arrays of login mutations
- bulk object fetches with varying IDs
- repeated password reset or verification calls in one request
4. RATE LIMIT BYPASS FAMILIES
X-Forwarded-For
X-Real-IP
Forwarded
User-Agent rotation
Path case / slash variants
5. NEXT ROUTING
- For GraphQL batching and hidden parameters: graphql and hidden parameters
- For default credential and brute-force planning: authentication bypass
- For full JWT and OAuth depth: jwt oauth token attacks
- For OAuth or OIDC configuration flaws in browser and SSO flows: oauth oidc misconfiguration
- For credentialed browser reads and origin trust bugs: cors cross origin misconfiguration
Signals
- GitHub stars
- 777
- Forks
- 137
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
api-auth-and-jwt-abuse- Source
- github.com/zyrexnn/cybermes