js-reverse
在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
- Installs
- 1.3K
- Last 24h
- +13
- Trending rank
- #7527
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/zhaoxuya520/reverse-skill --skill js-reverse- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads js-reverse automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
MCP 前端 JS 逆向作业规范
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-reverse.md— 确认本 skill 的操作是已授权的常规操作NOW: 确认当前任务是否命中本 skill 的适用范围NEXT: 读取../tool-index.md，校验工具可用性和实际路径NEXT: 缺工具时调用 bootstrap，不要猜路径ACT: 进入"工作流"第一步并执行，不要停在确认状态
适用范围
当任务属于以下场景时优先使用本 skill：
- 定位接口签名、加密参数、风控字段
- 观察页面请求链路与脚本来源
- 在运行时抓取函数入参与返回值
- 追踪某个 XHR/Fetch/WebSocket 的触发点
- 把页面证据带回 Node 做本地复现与补环境
如果目标是二进制、APK、PE、ELF、DLL、SO，请改用 ida-reverse、radare2 或 reverse-engineering。
当前环境默认工具映射
本 skill 不假设存在裸工具名，而是默认绑定当前客户端环境里可用的 js-reverse_* 工具。
如果当前任务明确提到 jshookmcp、JS hook、CDP、浏览器断点、网络拦截、SourceMap 或 AST 去混淆，也仍然走本 skill；只是把底层 MCP 面切到 jshookmcp，而不是把它当成一个新的总入口。
前提条件：jshookmcp 不是本地裸命令工具，而是一个要先下载、显式注册并启用的 MCP server。只有在所选客户端（Claude、Codex 等）的 MCP 配置里接入并启用后，相关工具面才真的可调用。
常用映射：
list_scripts->js-reverse_list_scriptsget_script_source->js-reverse_get_script_sourcesearch_in_sources->js-reverse_search_in_sourcesbreak_on_xhr->js-reverse_break_on_xhrevaluate_script->js-reverse_evaluate_scriptget_paused_info->js-reverse_get_paused_infoset_breakpoint_on_text->js-reverse_set_breakpoint_on_textlist_network_requests->js-reverse_list_network_requestsget_request_initiator->js-reverse_get_request_initiatorget_websocket_messages->js-reverse_get_websocket_messagestake_screenshot->js-reverse_take_screenshotnew_page->js-reverse_new_pagenavigate_page->js-reverse_navigate_pageselect_page->js-reverse_select_pageselect_frame->js-reverse_select_framepause/resume->js-reverse_pause_or_resume
如果未来工具名前缀变化，先更新本节，不要在执行时临时猜测。
jshookmcp 的定位
- 角色：
js-reverse的增强执行面，不是独立总控 - 适合：浏览器自动化、CDP 调试、JS Hook、网络拦截、SourceMap 重建、AST 辅助理解
- 调用前提：先把
@jshookmcp/jshook下载并注册到 MCP 客户端配置里，然后确保该 server 已启用 - 建议入口：仍然按
Observe → Capture → Rebuild执行，只是在Observe/Capture阶段优先调用 jshookmcp 的浏览器与 Hook 能力 - 与 anything-analyzer 关系：两者都能做浏览器/网络侧取证；anything-analyzer 更偏抓包与 HTTP 分析，jshookmcp 更偏 JS 运行时、CDP、Hook 和源码理解
核心原则
Observe-firstHook-preferredBreakpoint-lastRebuild-orientedEvidence-first
先页面观察，再最小化采样，再做本地补环境，不要跳过取证直接猜环境。
五阶段工作流
1. Observe
目标：先确认目标请求、相关脚本、候选函数，不猜环境。
默认动作：
- 用
js-reverse_new_page或js-reverse_navigate_page打开目标页面 - 用
js-reverse_list_network_requests找目标请求 - 用
js-reverse_get_request_initiator回溯调用来源 - 用
js-reverse_list_scripts、js-reverse_search_in_sources缩小脚本范围
必须产出：
- 目标请求 URL 或特征
- initiator 线索
- 可疑脚本 URL
- 初始任务记录
2. Capture
目标：对目标请求做最小侵入采样，拿到参数样例、调用顺序、运行时证据。
规则：
- 优先
js-reverse_break_on_xhr - 优先
js-reverse_evaluate_script做轻量运行时观察 - 命中后先看
js-reverse_get_paused_info - 必要时再用
js-reverse_set_breakpoint_on_text
3. Rebuild
目标：把页面证据整理成本地可迭代的 Node 复现材料。
规则：
- 本地补环境必须以页面观测证据为依据
- 不允许空想式补
window/document/navigator/crypto/storage - 每次只记录一个最小因果补丁决策
4. Patch
目标：按报错和 first divergence 驱动补环境，直到本地脚本稳定跑出目标参数。
规则：
- 先看缺什么，再补什么
- 一次只做一个最小补丁决策
- 每次补丁后立即复测
- 每次补丁都写入任务记录
5. DeepDive
目标：本地跑通后，再做去混淆、控制流还原、业务逻辑提纯。
规则：
- 如果当前任务只是出签名，这一阶段可以降级
- 如果要长期复用算法链路，这一阶段必须做
- Issue #65 混淆旁路（U–AV §4）：JSVMP（AD）→
E-js-vmp；CFF+字符串数组（AE）→E-js-deobf；DevTools/debugger 反调试（AF）→E-js-anti-debug。完整触发表见../reverse-engineering/references/nonpe-format-cookbook.md；AST 细节仍用references/ast-deobfuscation.md
执行要求
- 所有重要步骤都要写入本地 task artifact
- 如果无法解释为什么调用某个工具，就不要调用
- 优先使用
js-reverse_*或 jshookmcp 的现成 MCP 能力直接取证，不要先写脚本重造能力 - 失败时按
references/fallbacks.md回退 - 输出遵循
references/output-contract.md
必读引用
- 自动化入口：
references/automation-entry.md - 参数默认值：
references/tool-defaults.md - 任务输入模板：
references/task-input-template.md - MCP 专用任务编排：
references/mcp-task-template.md - 任务产物：
references/task-artifacts.md - 本地复现：
references/local-rebuild.md - 补环境：
references/env-patching.md - Node 复现：
references/node-env-rebuild.md - 插桩：
references/instrumentation.md - AST 去混淆：
references/ast-deobfuscation.md - 非 PE/JS 混淆菜谱 U–AV：
../reverse-engineering/references/nonpe-format-cookbook.md（AD/AE/AF） - 回退：
references/fallbacks.md - 输出契约：
references/output-contract.md
路由上下文
上游入口: skills/SKILL.md（总控）、routing.md
上游备选:
- anything-analyzer MCP（端口 23816）的浏览器工具可作为替代或补充
- jshookmcp 可作为更强的浏览器/CDP/Hook/Network/SourceMap/AST 执行面
reverse-engineering/SKILL.md（如果目标不是前端 JS）
下游出口:
- 需补环境 →
references/env-patching.md - 需本地复现 →
references/local-rebuild.md/references/node-env-rebuild.md - 需去混淆 →
references/ast-deobfuscation.md - 走不通时回退 →
references/fallbacks.md
同级关联模块: anything-analyzer MCP（浏览器自动化和 HTTP 捕获能力可以互补）
按需自举（On-Demand Bootstrap）
本 skill 依赖的 MCP 能力可通过统一自举系统安装；MCP 客户端注册必须显式选择目标，默认不会写任何客户端全局配置。
自动化能力边界
| 能力 | 可自动注册 | 方式 | 说明 |
|---|---|---|---|
| jshookmcp | ✓ | npm-mcp（npx 启动） | 显式选择 Claude / Codex / Both 后注册 |
| anything-analyzer | ✓ | local-http-mcp | 可自动启动服务；客户端注册须显式选择 |
| Node.js | ✓ | winget 安装 | 运行时依赖 |
自举方式
# 安装并注册 jshookmcp；Codex 可替换为 Claude 或 Both
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('jshookmcp') -McpHostTarget Codex
# 注册并启动 anything-analyzer
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices -McpHostTarget Codex
注意事项
jshookmcp注册后仍需在 AI 客户端中启用该 MCP server 才能调用- 不传
-McpHostTarget时只安装/准备能力并返回 registration-required，不修改 Claude 或 Codex 配置 anything-analyzer需要 pnpm 和项目源码，bootstrap 会自动 clone 并安装依赖- 如果 Node.js 未安装，bootstrap 会先通过 winget 安装 Node.js 22
<br><br>## 任务完成自检（声称完成前 MUST 通过）
- 我是否执行了工作流中的每一步（而不是只阅读）？
- 我是否基于
tool-index使用了真实工具路径？ - 我是否产出了可复现证据（命令/脚本/截图/报告）？
- 我是否完成并回写了 RULES 要求的 Checklist 项？
FAQ
What does the js-reverse skill do?
在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
How do I install js-reverse?
Run npx skills add https://github.com/zhaoxuya520/reverse-skill --skill js-reverse in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/js-reverse/ (personal) or .claude/skills/js-reverse/ (project).
Which AI agents can use js-reverse?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is js-reverse safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains js-reverse?
It is published by zhaoxuya520 in zhaoxuya520/reverse-skill. It has 1,290 recorded installs.
More from zhaoxuya520/reverse-skill
reverse-engineering
zhaoxuya520/reverse-skill
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
pentest-tools
zhaoxuya520/reverse-skill
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
apk-reverse
zhaoxuya520/reverse-skill
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
reverse-skill-router
zhaoxuya520/reverse-skill
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
ida-reverse
zhaoxuya520/reverse-skill
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "看看这个exe", "分析这个dll", "帮我破解", "找一下密码", "这个软件怎么注册", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.
radare2
zhaoxuya520/reverse-skill
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, rabin2, rasm2, radiff2, r2pipe, or asks for radare2 command help on Windows/Linux/macOS.
Popular ai & agents skills
google-agents-cli-publish
google/agents-cli
This skill should be used when the user wants to "publish an agent", "publish my ADK agent", "register an agent with Gemini", "publish to Gemini" (formerly Gemini Enterprise), or needs guidance on the agents-cli publish gemini command. Also use when the user wants to "manage agents in Agent Registry", "list/update/delete registered agents", or "register an MCP server". Covers ADK vs A2A registration modes, programmatic and interactive usage, flag reference, auto-detection from deployment metadata, Agent Registry fleet management, and troubleshooting. Part of the agents-cli skills suite. Do NOT use for deployment (use google-agents-cli-deploy).
google-agents-cli-eval
google/agents-cli
This skill should be used when the user wants to "run an evaluation", "evaluate my agent", "evaluate my ADK agent", "write an eval dataset", "analyze eval failures", "compare eval results", "optimize agent", or needs guidance on the Gemini platform eval methodology and the Quality Flywheel. Covers eval metrics, dataset schema, LLM-as-judge scoring, and common failure causes. Applies to any agents-cli project, whatever framework the agent is written in. Do NOT use for agent API code patterns (ADK: use google-agents-cli-adk-code), deployment (use google-agents-cli-deploy), or project scaffolding (use google-agents-cli-scaffold).
skill-creator
anthropics/skills
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
codex-pet
prime-skills/runcomfy-agent-skills
Codex Pet generator on RunComfy. Build a Codex-compatible Codex Pet spritesheet.webp + pet.json from a single reference image, drop it into ${CODEXHOME:-$HOME/.codex}/pets/ / and Codex picks it up as a custom Codex Pet next to the 8 built-ins. This skill produces the exact Codex Pet atlas Codex expects (1536x1872 PNG/WebP, 8 cols x 9 rows, 192x208 cells, 9 animation states — idle, running-right, running-left, waving, jumping, failed, waiting, running, review). Calls OpenAI GPT Image 2 edit ONCE via the local RunComfy CLI as runcomfy run openai/gpt-image-2/edit to produce a canonical Codex Pet pose, then assembles all 9 animation rows programmatically with ImageMagick micro-transforms — no Codex Pro, no $imagegen, no OPENAIAPIKEY required, only RUNCOMFYTOKEN. Triggers on "codex pet", "create codex pet", "make codex pet", "hatch codex pet", "/hatch image", "desktop pet codex", "codex pets", "spritesheet.webp", or any explicit ask to build a custom pet for OpenAI Codex.
full-output-enforcement
leonxlnx/taste-skill
Overrides default LLM truncation behavior. Enforces complete code generation, bans placeholder patterns, and handles token-limit splits cleanly. Apply to any task requiring exhaustive, unabridged output.
executing-plans
obra/superpowers
Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution, or no subagent tool is available