js-reverse
Front-end JavaScript reverse engineering: locate signature chains, analyze encrypted request parameters, sample runtime behavior, and reproduce logic locally in Node for evidence-based output.
⚠️ AUTHORIZED USE ONLY
This skill is for educational purposes or authorized security assessments only.
You must have explicit, written permission from the system owner before using this tool.
Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate
Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
1. Ask the user to state the exact target URL, IP, account, or resource.
2. Ask the user to confirm written authorization and the permitted scope.
3. Show the exact command(s) and explain their expected effect.
4. Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
MCP 前端 JS 逆向作业规范
When to Use
- Understanding how a web application signs or encrypts API requests.
- Reproducing client-side crypto locally to validate analysis.
适用范围
当任务属于以下场景时优先使用本 skill：
- 定位接口签名、加密参数、风控字段
- 观察页面请求链路与脚本来源
- 在运行时抓取函数入参与返回值
- 追踪某个 XHR/Fetch/WebSocket 的触发点
- 把页面证据带回 Node 做本地复现与补环境
如果目标是二进制、APK、PE、ELF、DLL、SO，请改用 ida-reverse、radare2 或 reverse-engineering。
当前环境默认工具映射
本 skill 不假设存在裸工具名，而是默认绑定当前客户端环境里可用的 js-reverse_* 工具。
如果当前任务明确提到 jshookmcp、JS hook、CDP、浏览器断点、网络拦截、SourceMap 或 AST 去混淆，也仍然走本 sk
Subscribers only
The full skill, its 13 bundled files and every download is included with every paid Complete AI plan.
Details
| Source | zhaoxuya520/reverse-skill |
|---|---|
| License | MIT |
| Risk label | offensive ("critical" means the skill may run commands or touch files — read before use) |
| Files | SKILL.md, references/ast-deobfuscation.md, references/automation-entry.md, references/env-patching.md, references/fallbacks.md, references/instrumentation.md, references/local-rebuild.md, references/mcp-task-template.md, references/node-env-rebuild.md, references/output-contract.md, references/task-artifacts.md, references/task-input-template.md, references/tool-defaults.md |
| Added | 2026-08-25 |
Related skills
accesslint-diff
Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing.
accesslint-scan
Audit a live page for accessibility issues, locate each WCAG violation precisely, and return a selector-grounded fix worklist without editing.
accint-commitments
Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").
accint-frames
Drain acc's deliberation queue — open/waiting brain_frames checkpointed by headless runs — via acc_act(runtime="continue").
accint-solve
Route a goal through acc's scored-memory loop via acc_act(runtime="solve"); deliberate any returned brain_frame and submit via continue.
ad-creative
Create, iterate, and scale paid ad creative for Google Ads, Meta, LinkedIn, TikTok, and similar platforms. Use when generating headlines, descriptions, primary text, or large sets of ad variations for testing and performance optimization.