skills.rest
zebbern
zebbernCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

js-analysis

Extract endpoints, API keys, and secrets from JavaScript code and bundles.

5|3|Updated Apr 10, 2026
Search Tags:#security#javascript#secrets#code-analysis#endpoints#analyze#api-keys
One-click install
npx skills add https://github.com/zebbern/termstack --skill js-analysis-zebbern
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-analysis
Source: https://github.com/zebbern/termstack/tree/main/.github/skills/js-analysis
Command: npx skills add https://github.com/zebbern/termstack --skill js-analysis-zebbern

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Analyze JavaScript files to identify hidden endpoints, API keys, secrets, and other sensitive data that pose security risks during development and testing.

Core Features & Use Cases

  • Endpoint discovery: Locate undocumented API endpoints embedded in JavaScript code and bundles.
  • Secret detection: Scan for keys, tokens, and credentials that may be exposed in client-side code.
  • Security testing aid: Support domain- and file-level assessments for web applications.

Quick Start

Provide a JavaScript file or URL to analyze and generate a report of endpoints and secrets.

Frequently Asked Questions about js-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden API endpoints and secrets in JavaScript code?▼

To find hidden API endpoints and secrets in JavaScript code, you can analyze single files or entire domains. The tool parses modern JavaScript syntax, bundles, and source maps to extract undocumented endpoints, API keys, and tokens for security reporting.

Can I scan an entire domain for exposed API keys and tokens?▼

Yes, you can scan an entire domain for exposed API keys and tokens. The analysis supports domain-level assessments to locate sensitive credentials across JavaScript bundles and source maps suitable for security testing and risk assessment.

Does JavaScript secret detection work with modern bundles and source maps?▼

JavaScript secret detection works with modern bundles and source maps. The analysis applies parsing logic to modern JavaScript syntax and bundled code to accurately identify and extract embedded endpoints and sensitive data.

What is the best way to extract undocumented endpoints from client-side JavaScript?▼

The best way to extract undocumented endpoints from client-side JavaScript is to run a dedicated code analysis. This process identifies embedded API paths within the code structure and generates structured results for security testing and code reviews.

How do I generate a structured security report from exposed credentials in JavaScript?▼

To generate a structured security report from exposed credentials in JavaScript, analyze the code to detect keys and tokens. The results are structured specifically for reporting to support risk assessment and security testing workflows.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

client-spa-endpoints

Extract API endpoints, hostnames, and routes from JavaScript bundles via static analysis.

Community
Advanced
managedcodemanagedcode
4

mcaf-security-baseline

Apply baseline security guidance to code and infrastructure changes.

Official
Intermediate
adaptive-enforcement-labadaptive-enforcement-lab
3

secure

Scan code, dependencies, and containers for vulnerabilities and generate SBOMs.

Official
Advanced
riparinoriparino
1

defensive-opsec

Detect credential leaks, subdomain exposure, and DNS misconfigurations across cloud services and code repositories.

Community
Advanced