Alei Xi Fast Spider Skills Kit Fast Spider Skills Kit

1. Core Architectural Skills

1.1 Config-Driven Architecture

Migrated from hardcoded fake_env.js templates to declarative JSON configuration. One config file per target — no code changes between platform deployments.

Before:  copy sign_template.js → hand-edit SDK paths → debug crash → repeat
After:   cp config/templates/default-anti-detect.json config/targets/<platform>.json
         → edit 5 fields → Toolkit.loadConfig('./config/targets/<platform>.json')

Entry point: src/index.js

const Toolkit = require('./src');
const config  = Toolkit.loadConfig('./config/targets/<platform>.json');
const win     = Toolkit.createBrowserFromConfig(config, {
    target: { test_url: '<target-test-url>' }
});

Key advantage: SDK rotation? Copy the old config, point sdk_path to the new bundle, run Phase 7 validation. Core logic untouched.

1.2 Five-Layer Defense System

Each layer fails independently — an attacker must breach all five to detect the sandbox. This is the toolkit's core competitive moat.

SDK probes navigator.plugins
  → L1 passes (instanceof PluginArray ✓)
  → L2 passes (item.toString() → [native code] ✓)
  → L3 active (cannot override PluginArray.prototype.item)
  → L4 records: {prop:"plugins", time:..., stack:"at SDK_init:42"}
  → L5 isolates this target's plugin config from other platform configs

1.3 Observability Design

Transforms "guess-based debugging" into "transparent diagnostics."

document.all access monitoring:

const win = Toolkit.createBrowser({ debugAll: true });
// ... run SDK in vm ...
const log = win.document.all.getAccessLog();
// → [{prop: "length", time: 1779091713398, stack: "at SDK._$clt (signer.js:1420)"}]

beforeParse lifecycle hook:

const win = Toolkit.createBrowser({
    beforeParse(win) {
        win.document.cookie = 'session=abc; token=xyz';
        win.__customState = { ts: Date.now() };
        console.log('[hook] window frozen with custom state');
    },
});

Structured logging (config-driven):

"logging": { "level": "debug", "output": "stderr" }

2. Capability Inventory

3. Operational Strategy

3.1 Three-Step Workflow

Step 1: ANALYZE        Step 2: CONFIGURE        Step 3: MONITOR & RUN
┌──────────────┐       ┌──────────────────┐     ┌──────────────────────┐
│ capture_sdk  │       │ cp templates/    │     │ debugAll: true       │
│ trace_env    │  →    │ default-anti-    │  →  │ getAccessLog()       │
│ identify     │       │ detect.json →    │     │ beforeParse inject   │
│ detection    │       │ targets/<name>.json │  │ Phase 7 validate     │
│ points       │       │ edit 5 fields    │     │ iterate if 403       │
└──────────────┘       └──────────────────┘     └──────────────────────┘

Step 1 — Analyze: Run capture_sdk.js (Phase 1), then trace_env.js (Phase 2). Identify which browser APIs the SDK touches. Note any unusual checks (e.g., document.all == undefined, specific GPU vendor strings).

Step 2 — Configure: Copy the baseline template, override only what differs:

cp config/templates/default-anti-detect.json config/targets/<platform>.json

Edit the 5 most common fields:

• target.name → "<platform-name>"
• target.test_url → actual API endpoint
• browser.user_agent → match captured page
• webgl.profile → "intel_integrated" or "nvidia_desktop"
• fingerprint.seed → 42 for regression, "random" for production

Step 3 — Monitor & Run: Enable document_all.monitoring_enabled: true. Run the signer. Inspect win.document.all.getAccessLog() to see exactly what the SDK probed. If 403, check:

1. document.all log — was typeof checked? (needs C++ addon)
2. WebGL vendor — wrong GPU profile? → setProfile()
3. Canvas toDataURL — wrong seed? → check Phase 7 response body

3.2 Adaptation Strategy

When a new anti-bot detection is encountered, the priority is: never modify core → always add config.

3.3 Phase Pipeline (Legacy Reference)

The 7-phase workflow from v1 remains the foundation. v2.1 adds config-driven automation on top:

Reminders

• Never skip Phase 2 — the Proxy tracer catches cold properties you'd miss from memory.
• process, require, global, module, Deno → undefined in sandbox.
• Fake XHR responseText must be valid JSON the SDK can parse.
• Call process.exit(0) after capturing signature — SDKs install timers.
• Param order in signed URLs matters — don't use URLSearchParams to clean them.
• New config before new code — always try a config override before touching src/env/.
• document.all == undefined cannot be faked in pure JS — enable monitoring first, then compile the C++ addon only if the target SDK checks this specific condition.

Source: alei-xi/fast-spider-skills-kit — distributed by TomeVault.