write-jsext

What problem does it solve?

Writing high-quality custom JavaScript scan modules for Vigolium is hard because you must match the expected module shape, choose correct passive vs active behavior, and return findings in the exact format that the scanner can deduplicate and report safely.

Core Features & Use Cases

• Passive extensions: Read stored HTTP request/response records and flag issues based on response evidence without sending new traffic.
• Active extensions: Send new requests, probe application behavior, and correlate responses to discover issues that require active testing.
• Finding authoring guidance: Produce well-structured finding objects (or call the finding factory) with accurate fields like matched evidence, severity, and optional raw request/response.
• Core API cheat-sheet: Use the vigolium.http, vigolium.parse, vigolium.utils, vigolium.log, vigolium.db, vigolium.scan, vigolium.oast, and (optional) vigolium.agent surfaces correctly to avoid common implementation mistakes.

Quick Start

Ask the assistant: "Write a passive Vigolium JavaScript extension that detects exposed debug headers in HTTP responses and returns findings with matched header evidence, then show me how to run it with run_extension."