js-analysislisted

Analyze JavaScript files (from Burp/proxy history, a URL list, or a recon JS dump) for security-relevant intel — hidden admin/internal/debug/test API endpoints, hidden parameters (debug/test/admin/role/bypass flags), hardcoded secrets (API keys, tokens, passwords, private keys), feature flags that unlock hidden functionality, dangerous developer comments, and client-side auth/authz logic. Extracts, categorizes, prioritizes by exploitability, emits ready-to-fire validation requests (Burp Repeater / curl), and writes a findings report. Use when a target's front end ships JS bundles and you want to mine them for attack surface. Never reports a secret or endpoint without a live test first.
z3r0s6/js-analysis-skill · ★ 0 · Data & Documents · score 72

Install: claude install-skill z3r0s6/js-analysis-skill

# JAVASCRIPT SECURITY ANALYSIS > Modern front ends ship the map to the back end. Bundlers inline every route, every parameter name, every feature flag, and too often a live credential. JS is where you find the endpoints that never appear in the UI — the admin panel behind a role check, the debug flag behind an env comparison, the `/api/v1/` legacy route no one deleted. Read the bundle, not the rendered page. The reader drives queries here: you decide what to pull out and what to fire. One bundle can hand you the entire private API surface. --- ## USAGE ``` /js-analysis <domain> e.g. /js-analysis app.example.com /js-analysis analyze the JS from my Burp requests /js-analysis <path-to-Burp-export-or-JS-dir> /js-analysis -l js_urls.txt ``` Examples: - `/js-analysis app.example.com` — collect JS from the live host, then run the full pipeline. - `/js-analysis analyze the JS from my Burp requests` — pull proxy history from the **Burp MCP**, filter JS responses, analyze (see §1.1). - `/js-analysis ~/burp/target-js/` — analyze a folder of already-saved `.js` files. - `/js-analysis -l js_urls.txt` — download + analyze a list of JS URLs. If the target is blank, the skill asks once (domain / Burp / dir), then proceeds without further prompts. --- ## REQUIREMENTS None are hard-required — the skill degrades to plain `curl`/grep — but these unlock the best paths: | Tool | Why | Check / setup | |---|---|---| | **Burp Suite MCP** | Read your live proxy hist