What problem does it solve? When you have access to a running web application but not its source code, discovering its API surface for OpenAPI spec generation is difficult. This Skill inspects the live app through Chrome DevTools MCP to extract endpoints from loaded JavaScript bundles and network traffic, producing structured recon artifacts for downstream spec building. ## Core Features & Use Cases - JS Bundle Endpoint Extraction: Enumerates loaded scripts, skips vendor bundles, and runs targeted regex passes over app bundles to find fetch, axios, XHR, and route constant patterns. - Secrets Detection: Scans frontend JavaScript for TruffleHog-style patterns (AWS keys, GitHub tokens, JWTs, private keys) and records only redacted previews with file offsets. - Optional Network Capture and Authentication: Authenticates via form, token, or cookie, then navigates the app to capture XHR/fetch traffic for higher endpoint coverage. - Use Case: A security engineer points the Skill at https://app.example.com with credentials, and receives routes.json, LIVE_RECON.md, and a redacted secrets report ready to feed into an OpenAPI spec builder. ## Quick Start Scan the live application at https://app.example.com for API endpoints and secrets, using authenticated access and network capture.
