skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

jxscout-bookmarks

Create and manage jxscout bookmark groups for security-relevant code.

11|1|Updated May 4, 2026
Search Tags:#web security#security research#client-side security#javascript analysis#jxscout#code bookmarking#vulnerability tracking
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill jxscout-bookmarks
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: jxscout-bookmarks
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/web-security/skills/jxscout-bookmarks
Command: npx skills add https://github.com/dreadnode/capabilities --skill jxscout-bookmarks

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the tedious, disorganized process of manually tracking interesting code snippets during client-side security research, ensuring all relevant sinks, gadgets, and flows are documented and easily accessible for later analysis.

Core Features & Use Cases

  • Bookmark Group Management: Create, update, and delete categorized groups for different types of security-relevant code (e.g., postMessage handlers, XSS sinks, authentication logic) with custom highlight colors for VS Code.
  • Precise Code Bookmarking: Mark exact line and column ranges in JS, HTML, or HTTP request/response files with markdown notes explaining why the code is security-relevant.
  • Use Case: When reviewing a web application's client-side code for XSS vulnerabilities, use this Skill to group all unvalidated postMessage handlers, bookmark each sink with notes about missing origin checks, and track multi-step request construction flows in dedicated groups.

Quick Start

Use the jxscout-bookmarks skill to create a bookmark group for XSS sinks, then bookmark all unvalidated postMessage handlers in the target JS file with notes explaining the missing origin check vulnerability.

Frequently Asked Questions about jxscout-bookmarks

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I track security-relevant JavaScript code during web security research?▼

You can track security-relevant JavaScript code by creating categorized bookmark groups to organize items like XSS sinks and postMessage handlers, adding markdown notes to document vulnerabilities directly within your research environment.

What is the best way to organize postMessage handlers and XSS sinks found during client-side security testing?▼

The best way to organize postMessage handlers and XSS sinks is to create distinct bookmark groups with custom highlight colors, allowing you to categorize and visually separate different vulnerability types for later analysis.

Can I add notes to specific code lines when bookmarking JavaScript vulnerabilities?▼

Yes, you can add markdown notes to specific code lines when bookmarking JavaScript vulnerabilities. This allows you to document exactly why the marked line or column range is security-relevant.

Does jxscout-bookmarks require a specific environment setup to manage security code bookmarks?▼

Yes, managing security code bookmarks requires the JXSCOUT_PROJECT_NAME environment variable to be set. It also uses the jxscout-pro-v2 CLI in client mode to interact with the VS Code extension.

What web asset types are supported for bookmarking during security research?▼

Supported web asset types for bookmarking include JavaScript, HTML, and HTTP-related files. You can mark exact line and column ranges across these assets to track request construction patterns and authentication logic.

How do I document multi-step request construction flows in web application code?▼

You document multi-step request construction flows by assigning them to dedicated bookmark groups. This keeps related code snippets organized and easily accessible for later vulnerability analysis.

Related Skills

Explore More Software Engineering Skills→
dreadnodedreadnode
11

jxscout-relationships

Map JavaScript files, iframes, and source map connections for web assets.

Official
Intermediate
0xShe0xShe
386

php-route-tracer

Trace PHP route handlers to sinks with branch evidence and controllability analysis.

Community
Advanced
Q16GQ16G
83

client-js-audit

Audit client-side JavaScript for DOM XSS and token handling risks.

Community
Intermediate
fishyerfishyer
1

cubox

Save URLs, articles, and memos to Cubox via the Cubox API.

Community
Basic