client-runtime-intelligence

Name: client-runtime-intelligence
Availability: InStock
Author: entrovyx

Analyze client-side JavaScript bundles to map API routes and authentication assumptions.

3|1|Updated Jul 2, 2026

Search Tags:#security #javascript #analysis #graphql #pentest #recon

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill client-runtime-intelligence

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: client-runtime-intelligence
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/meta/client-runtime-intelligence
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill client-runtime-intelligence

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of identifying hidden attack surfaces and logic flaws within complex client-side applications by systematically mapping front-end code to backend API structures.

Core Features & Use Cases

Route and API Mapping: Automatically identifies API base paths, GraphQL queries, and hidden endpoints from JavaScript bundles.
Trust-Mismatch Analysis: Detects discrepancies between client-side role checks and server-side enforcement to identify potential IDOR or privilege escalation vulnerabilities.
Manual Test Queue Generation: Converts discovered client-side logic into actionable, high-value security hypotheses for manual penetration testing.

Quick Start

Use the client-runtime-intelligence skill to analyze the provided JavaScript bundle and generate a list of potential trust-mismatch vulnerabilities.

Frequently Asked Questions about client-runtime-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find hidden API endpoints in JavaScript bundles?▼

Finding hidden API endpoints in JavaScript bundles involves systematically parsing client-side runtime code to reconstruct API route maps. This process maps front-end logic directly to backend API structures to expose hidden parameters.

What is client-side trust-mismatch analysis in web security?▼

Client-side trust-mismatch analysis detects discrepancies between client-side role checks and server-side enforcement. It identifies potential IDOR or privilege escalation vulnerabilities by analyzing front-end authentication assumptions.

Can I extract GraphQL queries from source maps for pentest recon?▼

You can extract GraphQL queries from source maps by analyzing client-side runtime code and front-end bundles. This systematic parsing reconstructs object graphs and identifies insecure transport assumptions for web security assessments.

How do I generate a manual test queue from front-end code analysis?▼

Generating a manual test queue from front-end code analysis converts discovered client-side logic into actionable, high-value security hypotheses. This guides manual penetration testing toward identified role-based access control gaps.

Does client-runtime-intelligence work for mobile security assessments?▼

Client-runtime-intelligence works for mobile security assessments where source maps or JavaScript assets are available for inspection. It systematically parses client logic to identify hidden attack surfaces and insecure transport assumptions.