| name | competition-jwt-claim-confusion |
| description | Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for JWT, JWS, and JWE validation paths, header parsing, key selection, claim acceptance, audience and issuer checks, role derivation, and token-to-identity confusion bugs. Use when the user asks to inspect JWT headers or claims, key lookup, `kid` handling, `alg` confusion, audience or issuer validation, role claims, or explain how a token becomes accepted identity or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here. |
Competition JWT Claim Confusion
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the decisive bug is not just "there is a JWT," but how headers, claims, and key selection turn into accepted identity.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Split the token path into parse, key lookup, signature or decryption, claim validation, and final acceptance.
- Record header fields, claims, key source, issuer, audience, and role mapping before mutating anything.
- Separate possession of a token from the exact service that accepts it.
- Keep parser behavior, trust policy, and resulting app session or privilege in one chain.
- Reproduce the smallest token-to-acceptance flow that proves the decisive confusion.
Workflow
1. Map Header And Key Selection
- Record header fields such as
alg, kid, typ, cty, jku, or embedded key material when present.
- Note where keys come from: static config, JWKS, local file, cache, or dynamic lookup.
