competition-jwt-claim-confusion

1# Competition JWT Claim Confusion
2 
3Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4 
5Use this skill when the decisive bug is not just "there is a JWT," but how headers, claims, and key selection turn into accepted identity.
6 
7Reply in Simplified Chinese unless the user explicitly requests English.
8 
9## Quick Start
10 
111. Split the token path into parse, key lookup, signature or decryption, claim validation, and final acceptance.
122. Record header fields, claims, key source, issuer, audience, and role mapping before mutating anything.
133. Separate possession of a token from the exact service that accepts it.
144. Keep parser behavior, trust policy, and resulting app session or privilege in one chain.
155. Reproduce the smallest token-to-acceptance flow that proves the decisive confusion.
16 
17## Workflow
18 
19### 1. Map Header And Key Selection
20 
21- Record header fields such as `alg`, `kid`, `typ`, `cty`, `jku`, or embedded key material when present.
22- Note where keys come from: static config, JWKS, local file, cache, or dynamic lookup.
23- Keep token parser, key selection path, and validation mode tied together.
24 
25### 2. Prove Claim-To-Privilege Acceptance
26 
27- Show how subject, audience, issuer, tenant, scope, role, or custom claims become app session, route access, or backend privilege.
28…