What problem does it solve? Web security testers often face minified production frontends where API endpoints, parameter encoding, signing logic, and token storage are hidden inside JavaScript bundles and source maps. This Skill turns that runtime evidence into a verifiable client attack surface without mistaking documentation examples or third-party scripts for real findings. ## Core Features & Use Cases - Client Surface Reconstruction: Recovers routes, URL/query/body constructors, encoding and signature hints, and token storage locations from first-party HTML, JS chunks, and source maps. - Source-to-Sink Tracing: Maps call chains from runtime entry points to DOM sinks or API endpoints, with confidence levels and evidence paths for each chain. - Disciplined Handoff Routing: Routes confirmed findings to downstream API, auth, IDOR, SQLi, DOM/XSS, or business-logic hunting workflows, and stops on WAF/429 signals instead of hammering the target. - Use Case: Given a saved SPA bundle and its source map, identify which functions build authenticated requests, how parameters are signed, and where tokens are read from storage, then hand the confirmed endpoint to API reverse-engineering. ## Quick Start Analyze the saved first-party JavaScript bundle and source map from the target scope to reconstruct its routes, parameter encoding, and token storage flow with evidence.
