# JWT Verification Review JWT Verification Review is a tested SKILL.md that reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402. - Page: https://aiskills402.com/skills/jwt-verification-review - Category: Code & Engineering (https://aiskills402.com/categories/code) - Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.0 - Card (JSON): https://api.aiskills402.com/v1/skills/jwt-verification-review ## Use it when Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the source. It leaves out the safe look-alikes, such as an algorithm list fixed in the verify call, an audience compared in a second step, and a decode that only reads the key id. Use to review login middleware, to audit token handling in a service, or to check an API before release. ## Not for OAuth redirect flows, session cookies that are not tokens, key rotation schedules, token storage in the browser and the internals of a library. It reads one piece of pasted verification code and judges only what is written in it. ## Tested, honestly Tested 2026-10-26. - Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 3 cases, read by hand. On the orders middleware it found the expiry check switched off and the secret typed into the source, and left out the algorithm list fixed to one name and the audience compared in a second step. On the session reader it found the algorithm taken from the token header and the admin decision read with decode, and left out the header read for the key id and the audience and issuer already passed to verify. On the clean billing verifier it answered exactly No findings. - Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on all 3 cases, read by hand. It matched the strong model on both planted modules, with sound fixes, and kept every safe look-alike out of its list: the fixed algorithm list, the second-step audience check, the key-id read and the key loaded from a file. On the clean verifier it answered exactly No findings. Note: Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us in Node with the jsonwebtoken library; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. The rule that an expiry check must not be switched off is the skill's own policy, because the standards do not demand an exp claim. Facts come from RFC 8725 and RFC 7519, read on 26 October 2026; there are no owner-measured facts. Full summary: https://aiskills402.com/skills/jwt-verification-review/tests ## Example ### English (claude-sonnet-5-5) Before: > const jwt = require('jsonwebtoken'); const SECRET = 'k9Zp2-vQx7mL4tRw-81fd30'; function requireAuth(req, res, next) { const token = (req.headers.authorization || '').replace('Bearer ', ''); try { const claims = jwt.verify(token, SECRET, { algorithms: ['HS256'], ignoreExpiration: true, }); if (claims.aud !== 'orders-api') { return res.sendStatus(403); }… After: > NO-EXP-CHECK — requireAuth, `ignoreExpiration: true` — the expiry check is switched off, so a stolen or old token stays valid forever — remove the option so `exp` is enforced HARDCODED-SECRET — requireAuth, `const SECRET = 'k9Zp2-vQx7mL4tRw-81fd30'` — the signing secret is in the source and in version control, so anyone with the code can forge tokens — read it from the environment or a secret… ## What is in the file - What the standards say, as published on 26 October 2026 - The answer - The codes - Rules - Work in this order - Short example ## Languages English ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/jwt-verification-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.0 - Size: 6.6 KB (6744 bytes) - SHA-256: 967be5e2a06a5c53c47da242fb85f9d642172679eb56a347fa08d4ffa53fc42b - Updated: 2026-10-26 - New versions are free through your re-download token. ## Versions ### 1.0.0 (2026-10-26) First release, written in the light-test batch of 26 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description. Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand. One wording change after the runs: the reason on the last line of the short example was reworded so that no sentence of SKILL.md repeats in the public example; rules and codes are unchanged, no re-run. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Algorithm list fixed to one name: reported? No. A fixed list in the verify call is the accepted form, whichever algorithm it names. The line is for a list taken back from the token header, for allowing none, or for a call that gives no list at all. ### Audience compared by hand after verify: reported? No. Comparing the claim in a second step counts as checking it, and one of audience or issuer is enough. The line appears only when neither is compared anywhere in the code. ### What code went into the test? Three small Node modules of our own. An orders middleware with a literal secret and expiry ignored, a session reader that trusts the header for the algorithm and uses decode to find admins, and a billing verifier that is correct. Claude Sonnet and Claude Haiku each reviewed every module once. ### What does a sound verifier return? Just the sentence No findings., nothing around it. A real problem arrives as its own line carrying a code, a function name, what goes wrong and how to repair it. The skill does not list what it looked at and approved. ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.