skills.rest
Chid0k
Chid0kCOMMUNITY
Explore all skills by this author →
GitHub

js-recon

Analyze JavaScript source code for security vulnerabilities and API endpoints.

Updated May 16, 2026
Search Tags:#javascript#security analysis#penetration testing#vulnerability detection#encryption analysis
One-click install
npx skills add https://github.com/Chid0k/claude-marketplace --skill js-recon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-recon
Source: https://github.com/Chid0k/claude-marketplace/tree/main/plugins/recon-plugin/skills/js-recon
Command: npx skills add https://github.com/Chid0k/claude-marketplace --skill js-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires jsbeautifier, pypdf2, pdfplumber, requests, beautifulsoup4, pyyaml, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the analysis of JavaScript source code, streamlining the process of identifying potential security vulnerabilities and weaknesses.

Core Features & Use Cases

  • JavaScript Code Analysis: Automatically scans JavaScript files for common security issues like SQL injection, XSS, and SSTI vulnerabilities.
  • API Endpoint Detection: Identifies API endpoints and categorizes them based on their risk level.
  • Authentication Flow Reconstruction: Maps out the authentication flow to identify potential bypasses or vulnerabilities.
  • Encryption Flow Analysis: Inspects how data is encrypted and decrypted within the code.
  • Secrets Assessment: Assesses the presence and potential exploitability of secrets like API keys or hardcoded passwords.
  • Admin and Hidden Functionality Detection: Identifies hidden features or routes that might indicate additional vulnerabilities.
  • GraphQL Analysis: Analyzes GraphQL code for potential security risks.
  • Object Structure and IDOR Analysis: Identifies objects within the code that might be vulnerable to IDOR attacks.
  • Use Case: A penetration tester analyzes a JavaScript file from a web application to identify potential security vulnerabilities.

Quick Start

Use the js-recon skill to analyze the JavaScript file 'app.js' for potential security vulnerabilities.

Frequently Asked Questions about js-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze JavaScript source code for security vulnerabilities during penetration testing?▼

JavaScript source code analysis identifies security vulnerabilities by scanning for SQL injection, XSS, and SSTI flaws. It maps API endpoints, authentication flows, and encryption practices to expose potential weaknesses and hardcoded secrets automatically.

What is the best way to detect hidden API endpoints and admin functionality in JavaScript files?▼

Detecting hidden API endpoints and admin functionality involves parsing JavaScript files to categorize routes by risk level. It identifies concealed features and maps API endpoints to reveal undocumented administrative access paths.

Can I identify IDOR vulnerabilities and GraphQL security risks by analyzing JavaScript code?▼

Identifying IDOR vulnerabilities and GraphQL security risks requires analyzing JavaScript object structures and GraphQL code. It inspects data models to detect insecure direct object reference patterns and potential query exploitation paths.

Do I need Python libraries like jsbeautifier and pdfplumber to scan JavaScript for hardcoded secrets?▼

Scanning JavaScript for hardcoded secrets requires Python libraries like jsbeautifier to parse and beautify source code. It depends on these specific dependencies to accurately assess the presence and exploitability of API keys or passwords.

How does reconstructing authentication flows from JavaScript help find security bypasses?▼

Reconstructing authentication flows from JavaScript helps find security bypasses by mapping how user credentials are verified. It exposes potential logic flaws or vulnerabilities in the authentication sequence that could allow unauthorized access.

Related Skills

Explore More Software Engineering Skills→
Himanshu040604Himanshu040604

firecrawl

Search, scrape, crawl, and extract clean markdown from web pages.

Community
Advanced
uphiagouphiago
1.1k

wp-plugin-automation

Automates WordPress vulnerability auditing by extracting plugin versions and matching CVEs from batches of target domains.

Community
Intermediate
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced
pdparchitectpdparchitect
13

hunt-dispatch

Fingerprint target infrastructure and load context-specific security attack modules.

Community
Advanced