How do I install the Recon JS Analysis skill?

Run npx skillmds@latest add noorqureshi/recon-js-analysis in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon JS Analysis safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon JS Analysis?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon JS Analysis free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Recon JS Analysis?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon JS Analysis by noorqureshi — Agent Skill

Name: Recon JS Analysis
Author: NoorQureshi

Recon JS Analysis

Mine JavaScript for endpoints, params, secrets, and hidden functionality. Load on SPAs, heavy JS apps, after crawling, or "analyze the JS". Signals: bundled JS (webpack/main.*.js), API calls in JS, source maps, /static/js, front-end frameworks.

NoorQureshi be4aa4d 1.8 KB Updated Sep 17, 2026

File contents

JavaScript analysis

When it applies

The app is JS-heavy (SPA). The front-end bundle is a map of the backend: it references API endpoints, parameters, feature flags, roles, and sometimes secrets — much of it not linked in the UI.

Why it works

Client code must know how to call the server, so endpoints/params are embedded in JS. Bundlers also occasionally ship source maps (full original source) and developers leave keys/comments.

Method

Collect all JS: katana -jc, subjs, or crawl; grab every .js (incl. lazy-loaded chunks).
Extract endpoints/params: linkfinder/jsluice pull URLs, paths, and param names from bundles.
Hunt secrets & flags: grep for apiKey|token|secret|internal|admin|debug, feature flags, and role checks done client-side (server may not enforce them → BOLA/BFLA leads).
Source maps: if .map files ship, reconstruct original source (source-map tools) → full whitebox-ish view.
Feed results: new endpoints → api-*; client-only auth checks → api-bola; secrets → validate.

Gotchas

Client-side "admin" gating usually isn't enforced server-side — test the endpoints directly.
De-obfuscate/beautify minified bundles before grepping (js-beautify).
Lazy-loaded chunks hide the juicy routes — enumerate all chunk files, not just main.js.

Verify success

Endpoints/params/secrets extracted from JS that weren't in the UI — new, testable surface.

References

LinkFinder/jsluice; katana; "JS recon" bug-bounty methodology.

Frequently asked questions