SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsjs-reverse-automation

js-reverse-automation

Security & auditing

View repository

Updated 10-15 09:44

About this skill

JS Reverse Engineering Automation Skill

Authorization Statement

  • Authorized Penetration Testing Statement Authorization purpose: Party A authorizes Party B to conduct security testing on information systems lawfully owned or lawfully authorized for management by Party A. The purpose is limited to identifying and remediating security risks and must not be used for any unauthorized access, control, or data use. Scope: Target URL Time: 2025-01-01 to 2026-12-31 Contact: 18188818868 Zhang Ceshi, Website Security Officer

Trigger Conditions

  • Use this Skill when the user needs to analyze browser-side sign / enc / token / form fields on an authorized site.
  • The task must keep the main chain complete: chrome-devtools-mcp browser connection, parameter chain tracing, entry discovery, JSRPC generation, Flask proxy generation, and Burp autoDecoder integration.

Required Inputs

Please provide input in the following format:

Target URL: https://xxx/login/index
Parameters To Analyze: password
Environment Constraints: none
Optional Fetch Example: fetch("https://xxx/Login/CheckLogin", {...})

Minimum required fields:

  • Target URL
  • Parameters To Analyze
  • Environment Constraints

Optional but strongly recommended:

  • Optional Fetch Example

Before performing any browser operation, first run scripts/check_inputs.py. For the detailed input/output contract, see references/output-contract.md。

Directory Structure Description

js-reverse-automation/
├── README.md # 项目说明、使用方式、更新说明和结构说明。
├── SKILL.md # Skill 主控文件。只负责定义任务如何被触发、必须输入什么、流程怎么分阶段、输出和验收怎么要求。
├── agents/
│   └── openai.yaml # Skill 的 agent 入口配置。负责定义默认提示词、默认输入格式和执行约束。
├── artifacts/ # 运行期目录，用来承接流程中间产物和最终校验报告。预期会出现的文件如下：
│   ├── artifacts/phase0_input.json # 规范化后的输入
│   ├── artifacts/phase1_trace.json # 浏览器链路复现结果
│   ├── artifacts/phase2_entrypoints.json # 参数入口识别结果
│   ├── artifacts/phase3_dependencies.json # 依赖、上下文和调用方式提取结果
│   └── artifacts/validation_report.json # 最终校验报告
├── references/
│   ├── references/workflow-recon.md # 阶段流程说明书。
│   ├── references/output-contract.md # 输入输出契约说明书。
│   ├── references/failure-recovery.md # 失败恢复和诊断格式说明书。
│   ├── references/validation-checklist.md # 验收标准说明书。
│   └── references/antidebug/
│       ├── references/antidebug/debugger-loop.md # 处理无限 debugger、eval、Function 类问题。
│       ├── references/antidebug/console-detect.md # 处理控制台检测、日志篡改、清屏等问题。
│       ├── references/antidebug/timer-check.md # 处理时间差、性能计时、Promise 时序检测。
│       ├── references/antidebug/env-detect.md # 处理窗口大小、webdriver、UA、DevTools 检测等环境识别问题。
│       ├── references/antidebug/proxy-guard.md # 处理跳转、关闭页面、history、代理拦截等链路阻断问题。
│       └── references/antidebug/dynamic-alias.md # 处理动态别名、wrapper、resolver 型入口和不稳定路径。
└── scripts/
    ├── scripts/check_inputs.py # 输入校验器。
    ├── scripts/emit_analysis_result.py # 统一分析产物生成器。
    ├── scripts/emit_jsrpc_stub.py # JSRPC 代码生成器。
    ├── scripts/emit_flask_proxy.py # Flask 代理生成器。
    ├── scripts/emit_burp_doc.py # Burp autoDecoder 文档生成器。
    └── scripts/validate_artifacts.py # 全链路校验器。

Phase Flow

  • Phase 0. Input Validation and Normalization
    • Validate the required fields and write out the normalized request JSON to be used in subsequent phases.
  • Phase 1. Browser Connection and Request Reproduction
    • Connect to a real browser via chrome-devtools-mcp, open the target page, and reproduce the request chain leading to the target parameter.
  • Phase 2. Parameter Entry Discovery
    • Locate how the target parameter is introduced, modified, or encrypted before the request is sent.
  • Phase 3. Call Path and Dependency Extraction
    • Extract callable entry functions,this bindings, runtime preconditions, and the dependency chain required to call the function outside the UI.
  • Phase 4. Generate analysis_result.json
    • Organize the findings from Phases 0-3 into a unified intermediate artifact.
  • Phase 5. Generate JSRPC Injection Code
    • Based on analysis_result.json generate the browser-side registration code, which must be directly manually testable, similar to a version such as /go?group=fausto&action=generate_password&param=111111 that directly returns the encrypted string.
  • Phase 6. Generate Flask Proxy Code
    • Generate a local proxy that forwards data to JSRPC and returns output compatible with Burp.
  • Phase 7. Generate Burp Integration Document
    • Generate an autoDecoder integration instruction document based on the same analysis artifact.
  • Phase 8. Verification and Diagnostics
    • Run scripts/validate_artifacts.pyand generate a verification report containing pass/fail details and remediation suggestions.

For the success conditions, failure handling, and continuation rules of each phase, see references/workflow-recon.md。

Output Requirements

When the workflow succeeds, this Skill must produce:

  • analysis_result.json
  • JSRPC injection code
  • Flask proxy code
  • Burp autoDecoder integration document
  • Verification report
  • Link for testing the effectiveness of the JSRPC injection code (e.g.http://127.0.0.1:12080/go?group=fausto&action=generate_password_md5&param=111111）
  • Flask proxy code (e.g. curl -X POST http://127.0.0.1:5000/encode
    -H "Content-Type: application/x-www-form-urlencoded"
    --data-urlencode "dataBody=username=111111&password=111111&code=1234&role=000002"）

All generators must use analysis_result.json as input. For output file requirements and schema details, see references/output-contract.md。

Failure handling principles

  • Fail early on missing input or a request chain that cannot be reproduced.
  • Do not use a guessed entry function as the final output.
  • Record diagnostic information including phase id, evidence, impact, and next action.
  • If anti-debugging is suspected, reference the exact rule files under references/antidebug/ and record the risk.
  • If the JSRPC, Flask, or Burp artifacts fail validation, keep the generated files but mark the validation report as failed.

For more detailed recovery rules, see references/failure-recovery.md。

Acceptance requirements

This Skill is only considered complete when the following conditions are met:

  • analysis_result.json passes contract validation.
  • The JSRPC code references a resolvable runtime entry point and exposes the configured action.
  • The Flask proxy compiles successfully, and the request rewriting logic is consistent with the target parameter list.
  • The Burp documentation includes the endpoint, HTTP method, required form fields, and verification steps.
  • The validation report includes pass/fail results and clear diagnostic information.

Final acceptance is based on references/validation-checklist.md .