skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

client-runtime-intelligence

Analyze client-side JavaScript bundles to map API routes and authentication assumptions.

3|1|Updated Jul 2, 2026
Search Tags:#security#javascript#analysis#graphql#pentest#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill client-runtime-intelligence
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: client-runtime-intelligence
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/meta/client-runtime-intelligence
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill client-runtime-intelligence

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of identifying hidden attack surfaces and logic flaws within complex client-side applications by systematically mapping front-end code to backend API structures.

Core Features & Use Cases

  • Route and API Mapping: Automatically identifies API base paths, GraphQL queries, and hidden endpoints from JavaScript bundles.
  • Trust-Mismatch Analysis: Detects discrepancies between client-side role checks and server-side enforcement to identify potential IDOR or privilege escalation vulnerabilities.
  • Manual Test Queue Generation: Converts discovered client-side logic into actionable, high-value security hypotheses for manual penetration testing.

Quick Start

Use the client-runtime-intelligence skill to analyze the provided JavaScript bundle and generate a list of potential trust-mismatch vulnerabilities.

Frequently Asked Questions about client-runtime-intelligence

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden API endpoints in JavaScript bundles?▼

Finding hidden API endpoints in JavaScript bundles involves systematically parsing client-side runtime code to reconstruct API route maps. This process maps front-end logic directly to backend API structures to expose hidden parameters.

What is client-side trust-mismatch analysis in web security?▼

Client-side trust-mismatch analysis detects discrepancies between client-side role checks and server-side enforcement. It identifies potential IDOR or privilege escalation vulnerabilities by analyzing front-end authentication assumptions.

Can I extract GraphQL queries from source maps for pentest recon?▼

You can extract GraphQL queries from source maps by analyzing client-side runtime code and front-end bundles. This systematic parsing reconstructs object graphs and identifies insecure transport assumptions for web security assessments.

How do I generate a manual test queue from front-end code analysis?▼

Generating a manual test queue from front-end code analysis converts discovered client-side logic into actionable, high-value security hypotheses. This guides manual penetration testing toward identified role-based access control gaps.

Does client-runtime-intelligence work for mobile security assessments?▼

Client-runtime-intelligence works for mobile security assessments where source maps or JavaScript assets are available for inspection. It systematically parses client logic to identify hidden attack surfaces and insecure transport assumptions.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

js-secrets-extraction

Extract hardcoded credentials and API keys from JavaScript bundles and source maps.

Community
Intermediate
allsmogallsmog
22

Exploit Techniques

Generate Python exploit templates for SQL and command injection vulnerabilities.

Community
Advanced
dougwithseismicdougwithseismic

mitm-start

Start the MITM proxy in headless mode and export HTTP/HTTPS proxy environment variables.

Community
Basic
dreadnodedreadnode
11

auth-matrix-testing

Test web application endpoints for authentication, authorization, and IDOR vulnerabilities.

Official
Advanced