How do I install the Analyze JS skill?

Run npx skillmds@latest add xrip/analyze-js in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Analyze JS skill do?

--- It is listed under Coding & Dev Tools on SkillMD.

Is Analyze JS safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Analyze JS?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Analyze JS free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Analyze JS?

xrip (@xrip) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Analyze JS by xrip — Agent Skill

Name: Analyze JS
Author: xrip

File contents

name: analyze-js description: Analyze JavaScript files for API endpoints, secrets, URLs, emails, sensitive files, and bundler versions examples: - analyze-js bundle.js - analyze-js src/ - analyze-js --verbose dist/

JS Analyzer Skill

Analyzes JavaScript files for security-relevant information using npx js-analyzer-cli. Works in any project without installation.

Command

npx js-analyzer-cli [OPTIONS] <paths...>

Detection Categories

endpoints: REST APIs, GraphQL, OAuth, admin panels
urls: External links, cloud storage, WebSockets
secrets: API keys, tokens, JWT, credentials (auto-masked)
emails: Valid addresses (test emails filtered)
files: Sensitive file references (.env, configs, backups)
bundlers: Detected bundlers with versions (Webpack, Vite, Rollup, etc.)

Auto-filters noise: build artifacts, module imports, XML namespaces.

Options

--verbose - Show progress details
--format=json - JSON output (default: toon)
--pretty - Pretty print JSON
--no-recursive - Skip subdirectories

Directory Scanning

Default behavior:

Finds .js, .jsx, .mjs files
Skips node_modules/ and hidden dirs
Recursive by default

Output Format

TOON format (default) - compact, LLM-optimized:

summary:
  total: 18
  endpoints: 4
  secrets: 1
findings:
  endpoints[4	]{value	location}:
    /api/v1/users	bundle.js:42:15
    /admin/dashboard	bundle.js:234:12
  secrets[1	]{value	location}:
    AKIA...MPLE (AWS Key)	bundle.js:312:25

Location format: file:line:column (clickable in IDEs)

How to Present Results

Start with summary, highlight critical findings (secrets, admin endpoints), group by category.

Example:

📊 Analysis: bundle.js (18 findings)

🔴 Critical:
• AWS Key at bundle.js:312:25
• Admin endpoint at bundle.js:234:12

Endpoints (4): /api/v1/users (bundle.js:42:15), /admin/dashboard (bundle.js:234:12), ...
Bundler: Webpack 5.88.2

Usage Flow

Identify paths
Add flags if needed
Run: npx js-analyzer-cli [flags] <paths>
Parse and present

Note: First run downloads package (~2s), then cached.

Security

For authorized testing only: pentesting, bug bounties, own applications, security audits.

---name: analyze-jsdescription: ---------name: analyze-jsdescription: Analyze JavaScript files for API endpoints, secrets, URLs, emails, sensitive files, and bundler versionsexamples: - analyze-js bundle.js - analyze-js src/ - analyze-js --verbose dist/---# JS Analyzer SkillAnalyzes JavaScript files for security-relevant information using `npx js-analyzer-cli`.Works in any project without installation.## Command```bashnpx js-analyzer-cli [OPTIONS] <paths...>```## Detection Categories- **endpoints**: REST APIs, GraphQL, OAuth, admin panels- **urls**: External links, cloud storage, WebSockets- **secrets**: API keys, tokens, JWT, credentials (auto-masked)- **emails**: Valid addresses (test emails filtered)- **files**: Sensitive file references (.env, configs, backups)- **bundlers**: Detected bundlers with versions (Webpack, Vite, Rollup, etc.)Auto-filters noise: build artifacts, module imports, XML namespaces.## Options- `--verbose` - Show progress details- `--format=json` - JSON output (default: toon)- `--pretty` - Pretty print JSON- `--no-recursive` - Skip subdirectories## Directory ScanningDefault behavior:- Finds `.js`, `.jsx`, `.mjs` files- Skips `node_modules/` and hidden dirs- Recursive by default## Output FormatTOON format (default) - compact, LLM-optimized:```summary: total: 18 endpoints: 4 secrets: 1findings: endpoints[4 ]{value location}: /api/v1/users bundle.js:42:15 /admin/dashboard bundle.js:234:12 secrets[1 ]{value location}: AKIA...MPLE (AWS Key) bundle.js:312:25```Location format: `file:line:column` (clickable in IDEs)## How to Present ResultsStart with summary, highlight critical findings (secrets, admin endpoints), group by category.Example:```📊 Analysis: bundle.js (18 findings)🔴 Critical:• AWS Key at bundle.js:312:25• Admin endpoint at bundle.js:234:12Endpoints (4): /api/v1/users (bundle.js:42:15), /admin/dashboard (bundle.js:234:12), ...Bundler: Webpack 5.88.2```## Usage Flow1. Identify paths2. Add flags if needed3. Run: `npx js-analyzer-cli [flags] <paths>`4. Parse and presentNote: First run downloads package (~2s), then cached.## SecurityFor authorized testing only: pentesting, bug bounties, own applications, security audits.

Frequently asked questions

Analyze JS