competition-bundle-sourcemap-recovery

Reconstructs runtime behavior from served JavaScript bundles, source maps, and chunk manifests.

7|4|Updated Jun 22, 2026
One-click install
npx skills add https://github.com/dbx0/skills --skill competition-bundle-sourcemap-recovery-dbx0
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: competition-bundle-sourcemap-recovery
Source: https://github.com/dbx0/skills/tree/main/skills/web-appsec/discovery/competition-bundle-sourcemap-recovery
Command: npx skills add https://github.com/dbx0/skills --skill competition-bundle-sourcemap-recovery-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Built frontend artifacts often hide routes, API endpoints, and feature flags inside minified bundles, chunk registries, and source maps, making it hard to understand what code actually executes at runtime. This Skill provides a structured workflow to map the served artifact set, trace loader flow, and recover hidden functionality from emitted assets during CTF sandbox engagements. ## Core Features & Use Cases - Served Artifact Mapping: Records entry HTML, script tags, build manifests, chunk registries, and source map URLs while keeping filenames, hash suffixes, and route ownership tied together. - Runtime Structure Reconstruction: Follows bootstrap code, chunk loaders, module registries, and string decoders to recover route names, API calls, feature flags, and hidden panels. - Decisive Path Reduction: Compresses findings into the smallest asset-to-runtime sequence proving which bundle path executes, separating served artifact truth from repository source. - Use Case: During a CTF web challenge, use this Skill to trace an obfuscated webpack loader, recover a hidden admin route from a lazy chunk, and prove the exact bundle path that triggers it. ## Quick Start Ask the agent to reconstruct the runtime structure of the served JavaScript bundles and recover any hidden routes or API endpoints from the source maps and chunk manifests.

Frequently Asked Questions about competition-bundle-sourcemap-recovery

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover hidden routes from minified JavaScript bundles?

Start from the build manifest and chunk registry rather than reading minified code directly. Follow the bootstrap loader and lazy import boundaries, then use source maps and stable symbol clusters to recover route names, API calls, and hidden panels.

How to use source maps to analyze a production frontend?

Locate source map URLs from the served artifact set, then map minified symbols back to original module names and file structure. Keep emitted filenames, hash suffixes, and chunk ids tied together so recovered symbols stay linked to the executing bundle.

Should I trust repository source code over served bundles?

No. The currently served artifact set is the runtime truth, and repository source may drift from what is deployed. Keep served artifact truth separate from source unless parity between them is explicitly proven.

When should this bundle recovery workflow not be used?

Avoid it when the decisive behavior lives in server-side rendering or template enforcement rather than built client assets. In those cases, hand off to a template-render analysis skill instead of deobfuscating frontend bundles.

What evidence should be preserved during bundle analysis?

Preserve served filenames, chunk ids, manifest entries, source map paths, recovered symbols, and endpoint strings. Also keep the exact executing bundle or module and one minimal asset-to-runtime sequence proving the decisive effect.