JWT None Algorithm Attack

JWT None Algorithm Attack is an AI Engineering skill for Claude Code, published by xalgord in xalgorix.

852 stars153 forkson xalgord/xalgorixAdded 2026/08/12+1% in starsRepository updated 2026/08/11

ai-agentai-securityautomationautonomous-pentestingbug-bountycybersecurityethical-hackinggolangpenetration-testingpentestpentesting-toolsreconsecuritysecurity-researchsecurity-toolstypescriptvulnerability-detectionvulnerability-scanner

Install in seconds

Install JWT None Algorithm Attack

Copy JWT None Algorithm Attack into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/xalgorix/xalgorix/tree/main/internal/tools/skills/data/api-security/performing-jwt-none-algorithm-attack ~/.claude/skills/performing-jwt-none-algorithm-attack

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/xalgorix/xalgorix.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: internal/tools/skills/data/api-security/performing-jwt-none-algorithm-attack/SKILL.md in xalgord/xalgorix
Installs to: ~/.claude/skills/performing-jwt-none-algorithm-attack
Collection: One of 51 skills cataloged from this repository
Category: AI Engineering — 2451 skills

What JWT None Algorithm Attack does

JWT None Algorithm Attack tests JWT implementations for acceptance of `alg: none` tokens that bypass signature verification. Use it during authorized security assessments to verify whether forged claims are rejected or accepted.

JWT None Algorithm Attack is cataloged under AI Engineering on DirSkills. JWT None Algorithm Attack comes from a repository tagged ai-agent, ai-security, automation, autonomous-pentesting and bug-bounty.

Documentation

README

Excerpt

Performing JWT None Algorithm Attack

Overview

The JWT none algorithm attack exploits a vulnerability in JSON Web Token libraries that accept tokens with the alg header set to none, effectively bypassing signature verification. When a server processes a JWT with "alg": "none", it treats the token as valid without checking any cryptographic signature, allowing attackers to forge tokens with arbitrary claims such as escalated privileges, impersonated users, or extended expiration times. This vulnerability was first disclosed by Tim McLean in 2015 and has affected multiple JWT libraries across languages.

When to Use

This is the opening of the README. Read the full README on GitHub.

Frequently asked about JWT None Algorithm Attack

What else does xalgord publish alongside JWT None Algorithm Attack?
JWT None Algorithm Attack is one of 51 skills that DirSkills catalogs from xalgord/xalgorix, the repository it ships in. Its siblings there include AFL++ Fuzzing, AI Security Guardrails and AI-Assisted Vulnerability Discovery. Each one is a separate skill with its own page in this directory, installs the same way JWT None Algorithm Attack does, and is maintained by xalgord in that same repository. The rest of the collection is listed on the xalgord/xalgorix page.
How does JWT None Algorithm Attack compare to other AI Engineering skills?
JWT None Algorithm Attack ranks #1521 by stars among the 2451 AI Engineering skills in this catalog. The most-starred ones next to it are Architecture Decision Records, AI-First Engineering and Agentic OS. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of JWT None Algorithm Attack against them. Open each page to compare what they document and how they install.