skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

recon-js-secrets

Scan JavaScript bundles for secret-like patterns and generate redacted reports.

Updated Jul 30, 2026
Search Tags:#security#javascript#reconnaissance#secrets#redaction#pentest
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-js-secrets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-js-secrets
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/recon-js-secrets
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill recon-js-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gitleaks, trufflehog, jq.

What problem does it solve?

This skill addresses the critical risk of accidental secret exposure in client-side JavaScript bundles, allowing security professionals to identify and triage credentials without inadvertently leaking them or triggering unauthorized service usage.

Core Features & Use Cases

  • Automated Secret Detection: Scans JavaScript files for API keys, tokens, and connection strings using Gitleaks, TruffleHog, and custom regex patterns.
  • Safe Triage Workflow: Classifies findings by severity and risk, ensuring that public-key patterns are ignored while genuine secrets are flagged for immediate rotation.
  • Strict Redaction: Enforces mandatory redaction of all sensitive values in evidence and logs to prevent secondary data leaks during the assessment process.

Quick Start

Use the recon-js-secrets skill to scan the downloaded JavaScript files in the current directory and generate a redacted report of potential credential exposures.

Frequently Asked Questions about recon-js-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan JavaScript bundles for exposed secrets?▼

To scan JavaScript bundles for exposed secrets, you can target local directory files to identify and classify API keys, tokens, and connection strings while enforcing strict redaction to prevent secondary data leaks.

How does secret detection in client-side JavaScript work during a pentest?▼

Secret detection in client-side JavaScript works by scanning bundle files using Gitleaks, TruffleHog, and custom regex patterns. It classifies findings by severity, ignores public-key patterns, and flags genuine credentials for rotation.

Can I use Gitleaks and TruffleHog to triage credentials without leaking them?▼

Yes, you can use Gitleaks and TruffleHog to triage credentials without leaking them by enforcing strict redaction policies on all discovered sensitive strings and evidence logs during the security assessment.

What is the best way to find API keys and tokens in JavaScript files?▼

The best way to find API keys and tokens in JavaScript files is using an automated secret detection workflow that classifies secret-like patterns by severity, ensuring genuine credentials are safely triaged for immediate rotation.

Do I need jq to scan JavaScript bundles for connection strings?▼

Yes, you need jq installed along with gitleaks and trufflehog as dependencies to properly process and parse output data while scanning JavaScript bundles for connection strings and secret-like patterns.

Related Skills

Explore More Software Engineering Skills→
robotostudiorobotostudio
172

vercel-react-best-practices

Guide React and Next.js performance optimization with rule files.

Official
Advanced
Clear-CapabilitiesClear-Capabilities
73

agentic-security:security-rotate-leak

Rotate leaked API keys and credentials end-to-end across supported providers.

Official
Advanced
pdparchitectpdparchitect
13

offensive-osint

Index probes, wordlists, and regex patterns for external reconnaissance.

Community
Advanced
EntroVyxEntroVyx
3

js-secrets-extraction

Extract hardcoded credentials and API keys from JavaScript bundles and source maps.

Community
Intermediate