skills.rest
Rifteo
RifteoOFFICIAL
Explore all skills by this author →
GitHub

js-analyzer

Analyze JavaScript files to uncover security vulnerabilities in web applications.

30|6|Updated May 13, 2026
Search Tags:#security#xss#javascript#csp#secret detection#endpoint discovery#pentest#bug bounty#prototype pollution#source map
One-click install
npx skills add https://github.com/Rifteo/skills --skill js-analyzer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-analyzer
Source: https://github.com/Rifteo/skills/tree/main/js-analyzer
Command: npx skills add https://github.com/Rifteo/skills --skill js-analyzer

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires katana, gau, waybackurls, hakrawler, gospider, getJS, sourcemapper, unwebpack-sourcemap, trufflehog, gitleaks, SecretFinder, jsluice, linkfinder, dalfox, ppfuzz, ppmap, retire.js, npm audit, js-beautify, synchrony, deobfuscate-js, csp-evaluator, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill provides a comprehensive methodology for analyzing JavaScript files to uncover security vulnerabilities and improve the quality of pentest reports.

Core Features & Use Cases

  • JavaScript File Discovery: Automated crawling and manual discovery methods for locating JS files.
  • Source Map Extraction: Detect and extract source maps to review unminified code.
  • Secret and Credential Hunting: Use automated tools and manual regex patterns to detect sensitive information.
  • Endpoint and API Route Mapping: Extract and map URLs and paths to identify API endpoints.
  • DOM-Based XSS Analysis: Identify dangerous sinks and controllable sources for DOM XSS.
  • Prototype Pollution: Detect vulnerable patterns and payloads to exploit prototype pollution.
  • postMessage Vulnerabilities: Find postMessage handlers and vulnerable patterns.
  • Client-Side Logic & Authorization Flaws: Identify role checks, feature flags, and hidden UI.
  • Insecure Storage Analysis: Analyze LocalStorage, SessionStorage, Cookies, IndexedDB, and Cache API.
  • Third-Party Library Vulnerability Scanning: Detect and assess vulnerabilities in third-party libraries.
  • JSONP & Legacy Callback Injection: Find JSONP endpoints and test for XSS exploitation.
  • WebSocket Analysis: Analyze WebSocket connections and origin bypass.
  • CSP Analysis & Bypass: Extract and parse Content Security Policy (CSP) and check for common bypass techniques.
  • Deobfuscation & Code Analysis: Deobfuscate JavaScript and analyze for eval sinks and open redirects.
  • Webpack / Bundler Specific Techniques: Analyze webpack bundles for DevServer exposure and environment variable leaks.
  • AngularJS / Angular Specific: Detect AngularJS and Angular sandbox escapes and template injection.
  • Report Structure: Provides a template for structuring vulnerability reports.
  • Quick-Reference: Priority Triage Order: Lists the priority of various security issues and how to triage them.

Quick Start

Run the js-analyzer skill on a target domain to start the analysis process.

Frequently Asked Questions about js-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find security vulnerabilities in JavaScript files during a pentest?▼

To find JavaScript security vulnerabilities, analyze files for DOM-based XSS, prototype pollution, and secret leaks using automated tools and manual regex patterns. This methodology uncovers sensitive endpoints, insecure storage, and client-side authorization flaws in web applications.

What is the best way to extract and analyze JavaScript source maps?▼

The best way to analyze JavaScript source maps is to detect and extract them to review unminified code. This process reveals original webpack bundles, environment variables, and hidden logic that standard minified script analysis misses.

How do I discover hidden API endpoints and routes in JavaScript?▼

To discover hidden API endpoints and routes, extract and map URLs and paths directly from JavaScript files. This identifies undocumented API surfaces, WebSocket connections, and JSONP endpoints for further penetration testing.

Can I detect and bypass Content Security Policy using JavaScript analysis?▼

Yes, you can detect and bypass Content Security Policy by extracting and parsing the CSP from JavaScript and HTML. This analysis checks for common bypass techniques and evaluates policy weaknesses for XSS exploitation.

Do I need Python and Node.js tools for JavaScript security analysis?▼

Yes, comprehensive JavaScript security analysis requires a range of Python and Node.js tools for crawling, source map extraction, and vulnerability scanning. These tools automate endpoint discovery, deobfuscation, and third-party library vulnerability scanning.

How do I deobfuscate JavaScript to find eval sinks and open redirects?▼

To find eval sinks and open redirects, deobfuscate JavaScript using specialized tools to transform packed code into readable formats. This reveals dangerous sinks, client-side logic flaws, and hidden UI elements for vulnerability reporting.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

hakrawler

Crawl web applications to discover URLs, endpoints, and JavaScript files.

Community
Intermediate
zapabobzapabob
2

sec-audit

Scan dependencies and custom code for security vulnerabilities.

Community
Advanced
rahmatullahbossrahmatullahboss

Cross-Site Scripting and HTML Injection Testing

Identify XSS vulnerabilities and craft payloads for stored, reflected, and DOM-based vectors.

Community
Advanced
TrevorEdrisTrevorEdris
2

security-review

Analyze pull request diffs and metadata to identify high-confidence security issues.

Community
Intermediate