skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

js-secrets-extraction

Extract hardcoded credentials and API keys from JavaScript bundles and source maps.

3|1|Updated Jul 2, 2026
Search Tags:#security#api#javascript#secrets#pentest#recon
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill js-secrets-extraction-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-secrets-extraction
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/js-secrets-extraction
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill js-secrets-extraction-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) components.

What problem does it solve?

This skill automates the discovery of sensitive information like API keys, tokens, and internal endpoints that are frequently leaked within modern JavaScript bundles and source maps.

Core Features & Use Cases

  • Automated Secret Scanning: Uses regex patterns to identify high-value secrets like AWS keys, JWTs, and Firebase configurations.
  • Source Map Analysis: Reconstructs and analyzes source maps to find credentials hidden in original source code.
  • Backend Discovery: Identifies internal API URLs and edge function paths that bypass standard WAF/CDN protections.

Quick Start

Use the js-secrets-extraction skill to scan the target website at https://example.com for hardcoded secrets and internal API endpoints.

Frequently Asked Questions about js-secrets-extraction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hardcoded API keys and secrets in JavaScript bundles?▼

To find hardcoded secrets in JavaScript bundles, you can scan modern web frameworks using regex-based pattern matching. This process identifies high-value credentials like AWS keys, JWTs, and Firebase configurations exposed in client-side code.

Can I extract internal API endpoints from React or Vue source maps?▼

Yes, you can extract internal API endpoints from React or Vue source maps by reconstructing the original source code. This backend discovery reveals internal API URLs and edge function paths that bypass standard WAF and CDN protections.

What types of credentials can regex pattern matching identify in frontend code?▼

Regex pattern matching identifies specific high-value credentials in frontend code, including AWS keys, JWTs, and Firebase configurations. It targets sensitive configuration data hardcoded within JavaScript bundles and source maps of modern web applications.

How do I scan a target website for leaked secrets in client-side JavaScript?▼

To scan a target website for leaked secrets in client-side JavaScript, you automate the discovery process using regex patterns and source map analysis. This targets modern web applications to extract sensitive configuration data and internal infrastructure.

Does this approach work with modern web frameworks like Angular and Vue?▼

Yes, this approach works with modern web frameworks like Angular and Vue. The analysis targets modern web applications built with these frameworks to extract sensitive configuration data and uncover security vulnerabilities in their client-side code.

Why analyze source maps instead of just the compiled JavaScript bundle?▼

Analyzing source maps is necessary because credentials are frequently hidden in the original source code rather than the compiled bundle. Reconstructing source maps exposes these security vulnerabilities and sensitive configuration data missed by standard bundle scanning.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

recon-js-analysis

Extract API endpoints, routing tables, and environment configurations from client-side JavaScript bundles.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

supply-chain-secrets

Detect hardcoded credentials and sensitive tokens in source code and Git history.

Community
Advanced
davpatel605-beepdavpatel605-beep

web-pentest

Perform authorized web application penetration testing with structured vulnerability classification and reporting.

Community
Advanced
AcczdyAcczdy
2

implementing-devsecops-security-scanning

Automate SAST, DAST, and SCA security scanning across CI/CD pipelines.

Community
Advanced