How do I install the JS Analysis skill?

Run npx skillmds@latest add zebbern/js-analysis in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the JS Analysis skill do?

Analyze JavaScript files to discover hidden endpoints, API keys, secrets, and sensitive data. Use when testing web applications, when user mentions JavaScript analysis, or when looking for hidden API endpoints. It is listed under Integrations & APIs on SkillMD.

Is JS Analysis safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with JS Analysis?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is JS Analysis free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published JS Analysis?

zebbern (@zebbern) published this skill. Their other Agent Skills are listed on their SkillMD profile.

JS Analysis by zebbern — Agent Skill

Name: JS Analysis
Author: zebbern

js-analysis

When to Use

Need to discover hidden API endpoints from JavaScript files
User mentions JavaScript analysis or JS file scanning
Looking for API keys, tokens, or secrets in client-side code
Analyzing single-page applications (SPAs)
Reverse engineering frontend applications
Finding undocumented API routes and parameters

Quick Start

Extract endpoints from a JavaScript file:

python linkfinder.py -i https://example.com/app.js -o cli

Find secrets in JavaScript files:

python SecretFinder.py -i https://example.com/app.js -o cli

Step-by-Step Process

Step 1: Identify JavaScript Files

Methods to Find JS Files:

# From page source
curl -s https://example.com | grep -oE 'src="[^"]*\.js"' | sed 's/src="//;s/"$//'

# Using browser dev tools
# Network tab > Filter by JS

# From Burp proxy history
# Filter by file extension .js

# From wayback machine
waybackurls example.com | grep "\.js$" | sort -u

# Using gau
gau example.com | grep "\.js$" | sort -u

Common JS File Locations:

/static/js/
/assets/js/
/dist/
/build/
/bundle.js
/app.js
/main.js
/vendor.js
/chunk-*.js

Step 2: LinkFinder - Endpoint Discovery

Basic Usage:

# Scan single JS file
python linkfinder.py -i https://example.com/app.js -o results.html

# CLI output (fast mode)
python linkfinder.py -i https://example.com/app.js -o cli

# Save to file
python linkfinder.py -i https://example.com/app.js -o cli > endpoints.txt

Scan Entire Domain:

# Enumerate all JS files on domain
python linkfinder.py -i https://example.com -d -o cli

# With output file
python linkfinder.py -i https://example.com -d -o domain_endpoints.html

Filter Results:

# Only API endpoints
python linkfinder.py -i https://example.com/app.js -r "^/api/" -o cli

# Admin routes
python linkfinder.py -i https://example.com/app.js -r "/admin" -o cli

# User-related endpoints
python linkfinder.py -i https://example.com/app.js -r "/user|/account|/profile" -o cli

Scan Local Files:

# Single file
python linkfinder.py -i /path/to/app.js -o cli

# Folder with wildcard
python linkfinder.py -i '/path/to/js/*.js' -o results.html

# All JS files recursively (with find)
find /path/to/js -name "*.js" -exec python linkfinder.py -i {} -o cli \;

Burp Suite Integration:

# Export from Burp: Target > Save selected items
python linkfinder.py -i burpfile.xml -b -o results.html

Step 3: SecretFinder - Secret Discovery

Basic Usage:

# Scan single JS file
python SecretFinder.py -i https://example.com/app.js -o cli

# HTML output
python SecretFinder.py -i https://example.com/app.js -o results.html

# Save to file
python SecretFinder.py -i https://example.com/app.js -o cli > secrets.txt

Scan Entire Domain:

# Extract all JS files and scan
python SecretFinder.py -i https://example.com -e -o cli

With Authentication:

# Add cookies
python SecretFinder.py -i https://example.com/app.js -c "session=abc123; token=xyz" -o cli

# Add headers
python SecretFinder.py -i https://example.com/app.js -H "Authorization:Bearer token\nX-Custom:value" -o cli

# With proxy
python SecretFinder.py -i https://example.com/app.js -p 127.0.0.1:8080 -o cli

Filter JS Files:

# Ignore specific files
python SecretFinder.py -i https://example.com -e -g "jquery;bootstrap;google" -o cli

# Process only specific files
python SecretFinder.py -i https://example.com -e -n "app.js;main.js;bundle.js" -o cli

Custom Regex:

# Use custom pattern
python SecretFinder.py -i https://example.com/app.js -r 'api_key=[a-zA-Z0-9]{32}' -o cli

Burp Suite Integration:

# Process Burp export
python SecretFinder.py -i burpfile.xml -b -o results.html

Step 4: Scan Local JS Files

Download JS Files First:

# Download single file
curl -o app.js https://example.com/static/js/app.js

# Download multiple files
while read url; do
  filename=$(basename "$url")
  curl -o "js_files/$filename" "$url"
done < js_urls.txt

Scan Downloaded Files:

# LinkFinder on folder
python linkfinder.py -i 'js_files/*.js' -o cli

# SecretFinder on folder
python SecretFinder.py -i js_files/ -o cli

Step 5: Analyze Webpack/Bundled Files

Extract Source Maps:

# Check for source map reference
grep -r "sourceMappingURL" *.js

# Download source map if available
curl -o app.js.map https://example.com/static/js/app.js.map

Unpack Source Maps:

# Using unwebpack-sourcemap
unwebpack-sourcemap app.js.map -o unpacked/

# Scan unpacked files
python linkfinder.py -i 'unpacked/**/*.js' -o cli
python SecretFinder.py -i unpacked/ -o cli

Beautify Minified JS:

# Using js-beautify
js-beautify -f minified.js -o beautified.js

# Then scan
python linkfinder.py -i beautified.js -o cli

Step 6: Combine with Other Tools

With gau/waybackurls:

# Get historical JS files
gau example.com | grep "\.js$" | sort -u > js_urls.txt

# Scan each URL
while read url; do
  echo "=== $url ===" >> results.txt
  python linkfinder.py -i "$url" -o cli >> results.txt 2>/dev/null
done < js_urls.txt

With httpx:

# Verify JS files exist
cat js_urls.txt | httpx -silent -mc 200 > valid_js.txt

# Scan valid files
while read url; do
  python SecretFinder.py -i "$url" -o cli
done < valid_js.txt

Step 7: Parse and Process Results

Extract Unique Endpoints:

# From LinkFinder CLI output
python linkfinder.py -i https://example.com/app.js -o cli | sort -u > endpoints.txt

# Filter by pattern
cat endpoints.txt | grep -E "^/api/" > api_endpoints.txt

Build Full URLs:

# Prepend base URL
cat endpoints.txt | sed 's|^|https://example.com|' > full_urls.txt

Test Endpoints:

# Check which endpoints exist
cat full_urls.txt | httpx -silent -mc 200,201,301,302,401,403 > valid_endpoints.txt

Step 8: Document Findings

Report Format:

## JavaScript Analysis Results

### Target: example.com

### JS Files Analyzed

- https://example.com/static/js/app.js
- https://example.com/static/js/vendor.js

### Endpoints Discovered

| Endpoint          | Method | Parameters |
| ----------------- | ------ | ---------- |
| /api/users        | GET    | id, limit  |
| /api/admin/config | GET    | -          |

### Secrets Found

| Type    | Value       | File      |
| ------- | ----------- | --------- |
| AWS Key | AKIA...     | app.js    |
| API Key | sk*live*... | vendor.js |

Secret Patterns Reference

Built-in SecretFinder Patterns

Pattern Name	Regex	Risk
google_api	`AIza[0-9A-Za-z-_]{35}`	High
google_oauth	`ya29\.[0-9A-Za-z\-_]+`	High
aws_access_key	`A[SK]IA[0-9A-Z]{16}`	Critical
aws_url	`s3\.amazonaws.com`	Medium
facebook_access_token	`EAACEdEose0cBA[0-9A-Za-z]+`	High
authorization_bearer	`bearer\s*[a-zA-Z0-9_\-\.=:_\+\/]+`	High
authorization_basic	`basic\s*[a-zA-Z0-9=:_\+\/-]+`	High
stripe_api	`sk_live_[0-9a-zA-Z]{24}`	Critical
twilio_api	`SK[0-9a-fA-F]{32}`	High
mailgun_api	`key-[0-9a-zA-Z]{32}`	High
json_web_token	`ey[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.?[A-Za-z0-9-_.+/=]*`	High
rsa_private_key	`-----BEGIN RSA PRIVATE KEY-----`	Critical

Custom Patterns to Add

# Add to SecretFinder.py _regex dictionary
'slack_token': r'xox[baprs]-[a-zA-Z0-9-]+',
'github_token': r'ghp_[a-zA-Z0-9]{36}',
'discord_token': r'[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}',
'heroku_api': r'[h|H][e|E][r|R][o|O][k|K][u|U].*[0-9A-F]{8}-[0-9A-F]{4}',
'firebase_url': r'https://[a-z0-9-]+\.firebaseio\.com',

Examples

Example 1: Basic JS Endpoint Discovery

Scenario: Extract all endpoints from a single JS file

Command:

python linkfinder.py -i https://acme.com/static/app.js -o cli

Output:

/api/v1/users
/api/v1/products
/api/v1/orders/{id}
/admin/dashboard
/graphql
/socket.io
/health
/api/internal/debug

Example 2: Domain-Wide Secret Scan

Scenario: Find all secrets across a domain's JS files

Command:

python SecretFinder.py -i https://acme.com -e -g "jquery;bootstrap;analytics" -o cli

Output:

[google_api] AIzaSyC3example_api_key_here123
  File: https://acme.com/static/js/maps.js

[stripe_api] stripe_live_example_key_redacted
  File: https://acme.com/static/js/checkout.js

[json_web_token] eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
  File: https://acme.com/static/js/auth.js

Example 3: Filter API Endpoints

Scenario: Extract only API-related endpoints

Command:

python linkfinder.py -i https://acme.com -d -r "^/api/|graphql|/v[0-9]/" -o cli

Output:

/api/v1/auth/login
/api/v1/auth/register
/api/v2/users/me
/graphql
/api/internal/metrics

Example 4: Authenticated Scan

Scenario: Scan JS files requiring authentication

Command:

python SecretFinder.py -i https://acme.com/dashboard -e \
  -c "session_id=abc123; auth_token=xyz789" \
  -H "Authorization:Bearer eyJhbGc..." \
  -o cli

Output:

[aws_access_key] AKIAIOSFODNN7EXAMPLE
  File: https://acme.com/static/js/admin.js

[authorization_bearer] Bearer admin_super_secret_token
  File: https://acme.com/static/js/config.js

Error Handling

Error	Cause	Resolution
Connection refused	Target unreachable	Check URL, try with proxy
403 Forbidden	WAF or access control	Add valid cookies/headers
SSL Error	Certificate issue	Use `-k` or add CA cert
Empty output	No patterns matched	Try with `-r` custom regex
Timeout	Large file or slow server	Download file locally first
Encoding error	Non-UTF8 file	Download and convert encoding

Tool Reference

LinkFinder Flags

Flag	Description
`-i, --input`	Input URL, file, or folder
`-o, --output`	cli for stdout, or filename.html
`-r, --regex`	Filter results with regex
`-d, --domain`	Analyze entire domain
`-b, --burp`	Parse Burp export file
`-c, --cookies`	Add cookies to requests

SecretFinder Flags

Flag	Description
`-i, --input`	Input URL, file, or folder
`-o, --output`	cli for stdout, or filename.html
`-e, --extract`	Extract all JS from page
`-r, --regex`	Custom regex pattern
`-b, --burp`	Parse Burp export file
`-c, --cookie`	Add cookies
`-H, --headers`	Add headers (Name:Value\n)
`-p, --proxy`	Set proxy (host:port)
`-g, --ignore`	Ignore JS files (string;string)
`-n, --only`	Process only specific JS files

Best Practices

Start with domain scan - Use -d or -e to find all JS files
Filter noise - Ignore vendor libraries (jquery, bootstrap)
Use CLI output - Faster and easier to process
Combine tools - LinkFinder for endpoints, SecretFinder for secrets
Check source maps - May reveal original source code
Test found endpoints - Verify with httpx or curl
Save results - Document all findings for reporting
Scan historical - Use wayback/gau for old JS versions

JS Analysis

File contents

js-analysis

When to Use

Quick Start

Step-by-Step Process

Step 1: Identify JavaScript Files

Step 2: LinkFinder - Endpoint Discovery

Step 3: SecretFinder - Secret Discovery

Step 4: Scan Local JS Files

Step 5: Analyze Webpack/Bundled Files

Step 6: Combine with Other Tools

Step 7: Parse and Process Results

Step 8: Document Findings

Secret Patterns Reference

Built-in SecretFinder Patterns

Custom Patterns to Add

Examples

Example 1: Basic JS Endpoint Discovery

Example 2: Domain-Wide Secret Scan

Example 3: Filter API Endpoints

Example 4: Authenticated Scan

Error Handling

Tool Reference

LinkFinder Flags

SecretFinder Flags

Best Practices

References

Frequently asked questions

JS Analysis

File contents

js-analysis

When to Use

Quick Start

Step-by-Step Process

Step 1: Identify JavaScript Files

Step 2: LinkFinder - Endpoint Discovery

Step 3: SecretFinder - Secret Discovery

Step 4: Scan Local JS Files

Step 5: Analyze Webpack/Bundled Files

Step 6: Combine with Other Tools

Step 7: Parse and Process Results

Step 8: Document Findings

Secret Patterns Reference

Built-in SecretFinder Patterns

Custom Patterns to Add

Examples

Example 1: Basic JS Endpoint Discovery

Example 2: Domain-Wide Secret Scan

Example 3: Filter API Endpoints

Example 4: Authenticated Scan

Error Handling

Tool Reference

LinkFinder Flags

SecretFinder Flags

Best Practices

References

Related skills

Frequently asked questions

How do I install the JS Analysis skill?

What does the JS Analysis skill do?

Is JS Analysis safe to use?

Which AI agents work with JS Analysis?

Is JS Analysis free to use?

Who published JS Analysis?