ast-deobfuscate

Reverses obfuscated JavaScript by decrypting strings and restoring control flow using Babel AST transformations.

20|4|Updated May 24, 2026
One-click install
npx skills add https://github.com/Big-fat-dog/js-spider --skill ast-deobfuscate-big-fat-dog
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ast-deobfuscate
Source: https://github.com/Big-fat-dog/js-spider/tree/main/.trae/skills/ast-deobfuscate
Command: npx skills add https://github.com/Big-fat-dog/js-spider --skill ast-deobfuscate-big-fat-dog

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @babel/parser, @babel/traverse, @babel/generator, @babel/types, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill enables the decryption and recovery of obfuscated JavaScript code, making it readable and understandable.

Core Features & Use Cases

  • JavaScript Code Decryption: Unravel string-encoded JavaScript, recover control flow, and eliminate dead code.
  • Use Case: If you encounter complex or obfuscated code, such as that with _0x prefixes, large string arrays, or control flow flattening, this Skill can help you decode and analyze it effectively.

Quick Start

To deobfuscate JavaScript code, use the 'ast-deobfuscate' skill and provide the path to the obfuscated JavaScript file.

Frequently Asked Questions about ast-deobfuscate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deobfuscate JavaScript code with string encryption and control flow flattening?

To deobfuscate JavaScript, you can use this Skill to decrypt strings, restore control flow, and remove dead code by transforming the Abstract Syntax Tree using Babel. Provide the file path to start the analysis.

Can I restore control flow flattening in obfuscated JavaScript using Babel?

Yes, restoring control flow flattening in obfuscated JavaScript is supported. The Skill traverses and manipulates the AST with Babel to restructure the flattened execution paths back into readable logic.

What is the best way to remove dead code from obfuscated JavaScript?

Removing dead code from obfuscated JavaScript is handled by analyzing the AST to identify and eliminate unreachable code paths. This process simplifies the code structure and significantly improves readability.

Does this AST deobfuscation approach work on files with large string arrays and _0x prefixes?

Yes, this AST deobfuscation approach works on files with _0x prefixes and large string arrays. It targets these specific obfuscation patterns to decrypt the strings and reveal the original logic.

Do I need Babel dependencies to reverse JavaScript obfuscation?

Yes, you need Babel dependencies to reverse JavaScript obfuscation. The Skill requires @babel/parser, @babel/traverse, @babel/generator, and @babel/types to parse, transform, and generate the recovered code.

What are the limitations of using AST transformations for JavaScript deobfuscation?

Using AST transformations for JavaScript deobfuscation is limited to static analysis of syntactic structures. It cannot execute dynamic code generation logic at runtime, meaning heavily dynamic obfuscation may not be fully reversed.