skills.rest
overtimepog
overtimepogCOMMUNITY
Explore all skills by this author →
GitHub

js-analysis

Analyze JavaScript bundles to extract source maps, API endpoints, and secrets.

Updated Aug 23, 2026
Search Tags:#javascript#analysis#secret detection#api discovery#vulnerability hunting#source maps
One-click install
npx skills add https://github.com/overtimepog/greyhatcc --skill js-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-analysis
Source: https://github.com/overtimepog/greyhatcc/tree/main/skills/js-analysis
Command: npx skills add https://github.com/overtimepog/greyhatcc --skill js-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of analyzing JavaScript bundles to discover hidden API endpoints, extract sensitive secrets, and identify potential client-side vulnerabilities.

Core Features & Use Cases

  • Bundle Discovery: Crawls web pages to find all JavaScript files, including those loaded dynamically.
  • Source Map Extraction: Locates and reconstructs original source code from source maps for deeper analysis.
  • Static Analysis: Scans JS code for API endpoints, hardcoded secrets (API keys, tokens), infrastructure details, and business logic flaws.
  • Use Case: A bug bounty hunter can use this Skill to quickly identify exposed API keys or sensitive endpoints within a web application's JavaScript, leading to high-impact findings.

Quick Start

Use the js-analysis skill to analyze the JavaScript on example.com.

Frequently Asked Questions about js-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden API endpoints in JavaScript bundles?▼

JavaScript bundle analysis discovers hidden API endpoints by crawling web pages to locate dynamically loaded files and statically scanning the code. This process extracts API endpoints and infrastructure details from client-side code.

What is source map extraction and how does it reveal original source code?▼

Source map extraction locates and reconstructs original source code from source maps associated with downloaded JavaScript files. This allows deeper static analysis of the reconstructed source to identify business logic flaws.

Do I need Playwright to crawl and analyze JavaScript files?▼

Yes, JavaScript bundle analysis requires Playwright for crawling web applications to find all JavaScript files, including those loaded dynamically, while Python scripts handle the static analysis and source map reconstruction.

Can I detect hardcoded secrets and API keys in client-side code?▼

Yes, static analysis scans client-side JavaScript code to detect hardcoded secrets such as API keys and tokens. This automated detection helps identify potential client-side vulnerabilities and exposed sensitive data.

What's the best way to analyze dynamically loaded JavaScript for vulnerabilities?▼

Analyzing dynamically loaded JavaScript for vulnerabilities requires crawling web pages with Playwright to find all loaded files, extracting source maps, and using Python scripts for static analysis to detect secrets and endpoints.

Why does source map extraction matter for bug bounty hunting?▼

Source map extraction matters for bug bounty hunting because it reconstructs original source code from downloaded JavaScript bundles, allowing deeper static analysis to quickly identify exposed API keys, sensitive endpoints, and business logic flaws.

Related Skills

Explore More Software Engineering Skills→
w7panelw7panel
182

webapp-testing

Automate local web application testing with Playwright and Python.

Official
Intermediate
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
luyi985luyi985

source-maps-debugging

Configures source maps to map compiled JavaScript back to TypeScript for debugging.

Community
Intermediate
xalgordxalgord
846

javascript-analysis

Analyze JavaScript assets to identify API endpoints, hardcoded secrets, and source maps.

Community
Intermediate