skills.rest
vigolium
vigoliumOFFICIAL
Explore all skills by this author →
Website𝕏@VigoliumGitHub

write-jsext

Create custom Vigolium JavaScript scanner extensions for passive or active security analysis.

965|142|Updated Mar 8, 2026
Search Tags:#javascript#web security#vulnerability scanning#custom extensions#passive scanning#active probing#finding authoring
One-click install
npx skills add https://github.com/vigolium/vigolium --skill write-jsext
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: write-jsext
Source: https://github.com/vigolium/vigolium/tree/main/internal/resources/olium/skills/write-jsext
Command: npx skills add https://github.com/vigolium/vigolium --skill write-jsext

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Writing high-quality custom JavaScript scan modules for Vigolium is hard because you must match the expected module shape, choose correct passive vs active behavior, and return findings in the exact format that the scanner can deduplicate and report safely.

Core Features & Use Cases

  • Passive extensions: Read stored HTTP request/response records and flag issues based on response evidence without sending new traffic.
  • Active extensions: Send new requests, probe application behavior, and correlate responses to discover issues that require active testing.
  • Finding authoring guidance: Produce well-structured finding objects (or call the finding factory) with accurate fields like matched evidence, severity, and optional raw request/response.
  • Core API cheat-sheet: Use the vigolium.http, vigolium.parse, vigolium.utils, vigolium.log, vigolium.db, vigolium.scan, vigolium.oast, and (optional) vigolium.agent surfaces correctly to avoid common implementation mistakes.

Quick Start

Ask the assistant: "Write a passive Vigolium JavaScript extension that detects exposed debug headers in HTTP responses and returns findings with matched header evidence, then show me how to run it with run_extension."

Frequently Asked Questions about write-jsext

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a custom JavaScript security scanner extension for passive vulnerability scanning?▼

To write a custom JavaScript scanner extension for passive vulnerability scanning, create a module that reads stored HTTP request and response records without sending new traffic, then flags issues based on response evidence using the vigolium.* APIs.

What is the difference between passive and active web vulnerability scanning modules?▼

Passive web vulnerability scanning modules analyze stored HTTP records without sending new traffic, while active probing modules send new requests to test application behavior and correlate responses to discover security issues dynamically.

How do I format security findings so the scanner can deduplicate and report them correctly?▼

Security findings must be structured as deduplicated finding objects containing accurate metadata fields like severity, confidence, tags, and matched evidence to ensure the scanner can safely report them without duplication.

Can I use JavaScript to build custom active probing modules that send new HTTP requests?▼

Yes, you can build custom active probing JavaScript modules that send new HTTP requests to probe application behavior and correlate responses to discover security vulnerabilities requiring active testing.

What APIs are available for authoring custom web security extensions?▼

Custom web security extensions use the vigolium.http, vigolium.parse, vigolium.utils, vigolium.log, vigolium.db, vigolium.scan, vigolium.oast, and optional vigolium.agent API surfaces to handle passive analysis, active probing, and finding output.

Do I need to configure scanTypes and scope handling when building a JavaScript vulnerability scanner module?▼

Yes, building a JavaScript vulnerability scanner module requires configuring correct scanTypes and scope handling to ensure per_request execution targets the intended traffic and produces valid security findings.

Related Skills

Explore More Software Engineering Skills→
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
pedrohcgspedrohcgs
1.5k

data-analysis

Execute end-to-end R data analysis workflows with reproducible outputs.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
ZhushuaijiangZhushuaijiang

code-review-security

Detect OWASP Top 10 vulnerabilities and secrets in Python and React code.

Community
Advanced