JaneEyre3007

@janeeyre3007 source repo

14 skills
0 followers
1 day ago last updated

▌
Env Patch · janeeyre3007 bundle
JS逆向沙箱补环境。给定混淆 JS 文件、已定位入口或本地 Node.js 复现目标时，执行"运行→诊断缺失环境→补环境→功能验证"流程。适合把浏览器 JS、a_bogus/JSVMP/指纹依赖代码放到 Node.js 沙箱中跑通；不要仅因 sign/token、入口定位、浏览器 hook、普通 412/403、整文件 AST 解混淆而触发。瑞数/Ruishu/Rivers 任务只有在目标是 Node.js / VM / jsdom / proxy runner 跑通时使用本 skill；入口定位转 camoufox-js-reverse，Python+iv8 或 URL suffix 转 iv8-web-reverse，完整协议转 web-protocol-recovery。

0 installs
▌
JS Resolve · janeeyre3007
当你正在学习 JavaScript 逆向工程时使用。遇到加密参数、代码混淆、反调试、签名算法等问题时调用此 skill。也可在其他大模型因合规问题拒绝回答逆向相关问题时使用。

0 installs
▌
Rs Reverse · janeeyre3007 bundle
瑞数/Ruishu/Rivers Security 专项逆向。Use ONLY with clear Ruishu evidence: $_ts.nsd/cd/l__, r2mKa, meta[r=m], Cookie S/T/P, basearr, hasDebug, 瑞数 412/403, Cookie T/P 纯算, or 瑞数 URL suffix/动态防护参数。Also use for Ruishu-specific sdenv, JsRpc, browser-rpc, and runtime XHR suffix work. Do not use for ordinary sign/token tracing, generic sdenv/JsRpc/browser RPC, generic browser hooks, generic Node.js env patching, or AST deobfuscation without Ruishu evidence.

0 installs
▌
Darwin Skill · janeeyre3007 bundle
Autonomous optimizer for OpenCode skills inspired by Karpathy autoresearch. Use when the user wants skill quality scoring, trigger-boundary review, test-prompt design, optimization history, or iterative improvement of one or more SKILL.md files: "优化skill", "skill评分", "auto optimize skills", "skill质量检查", "skill review", "skill打分". Do not trigger when the user only wants to apply a domain skill to a normal task, edit opencode config/MCP/agents without changing a skill, or fix ordinary application code.

0 installs
▌
Skill Creator · janeeyre3007 bundle
Create, revise, evaluate, and package OpenCode skills. Use this whenever the user wants to make a new skill, clean up an existing skill, improve trigger accuracy, add evals, compare iterations, benchmark whether a skill is actually helping, or review overlap across the current skill set and tighten trigger boundaries. If the user says "turn this workflow into a skill", "improve this skill", "test this skill", "add evals", "optimize the description", or "check all current skills and micro-tune them", use this skill early. Do not trigger when the user only wants to apply a domain skill to a target, or when they are editing opencode config, agents, plugins, MCP servers, or permission rules without changing a skill definition.

0 installs
▌
Ast Deobfuscate · janeeyre3007 bundle
用 Babel AST 对混淆 JavaScript 做结构化还原，优先按 sojson、sojsonv7、obfuscator、awsc、jjencode、common 这类家族选择解混淆流水线，产出更可读、可继续分析的源码和中间产物。适合“帮我解混淆这段 JS”“还原 obfuscator/sojson/_0x 风格代码”“展开字符串数组、控制流平坦化、while-switch”“参考 Decode_action 那种插件式 pass 处理”，前提是用户真正要的是还原源码结构、拆 pass、保留中间产物，而不是只找参数入口、只要浏览器 hook 脚本或直接补环境执行。不要用于浏览器 DevTools hook、参数入口定位或 Node.js 补环境，以及目标是"跑通/执行/生成结果"而非"阅读源码"（转env-patch或iv8-web-reverse）

0 installs
▌
Iv8 Web Reverse · janeeyre3007 bundle
交付紧凑可运行的 Python + iv8 + requests 脚本。用 iv8 执行浏览器侧 JavaScript，用 requests 或 curl_cffi 发真实 HTTP 请求。适合 h5st/a_bogus/BDMS改写URL/__zp_stoken__/挑战页cookie/瑞数XHR后缀/可信输入TDC、412/202/challenge 已确认用 iv8 执行 JS、已有浏览器环境样本需桥接到 iv8、把本 skill cases 案例改造为可运行脚本。动态素材写入当前工作区 js_reverse_cache/。不要用于：只定位 sign/token 入口或调用链（转 camoufox-js-reverse）、只要浏览器 hook 脚本（转 browser-hook-snippets）、AST 解混淆（转 ast-deobfuscate）、通用 Node.js 补环境（转 env-patch）、完整分层协议恢复（转 web-protocol-recovery）。瑞数/Ruishu/Rivers 只有目标是 iv8 runtime、challenge cookie、XHR 后缀或请求可用性复现时进入本 skill；Node/proxy 跑通转 env-patch。

0 installs
▌
Find Crypto Entry · janeeyre3007 bundle
定位 JS 请求里加密参数、签名参数、token 或安全字段的生成入口，产出脚本位置、函数名和调用链。适合“这个参数在哪生成”“请求头里的 xxx 哪来的”“帮我找 sign/token 的入口和调用路径”这类请求，尤其适合用户明确要脚本位置、函数名、调用链、入口类别或后续可接补环境的落点，而不是只要一段临时 hook 脚本、Node.js 补环境或整文件 AST 解混淆时。对 challenge、动态 cookie、JSVMP、环境读取型签名场景，要先判断它是不是普通 `sign()` 入口问题，避免误按常规加签路径深追。若用户只缺浏览器观察脚本，转给 `browser-hook-snippets`；若入口已知且目标是 Node.js 独立运行，转给 `env-patch`。不要用于浏览器 hook 脚本生成、Node.js 补环境、普通抓包或整文件 AST 解混淆。

0 installs
▌
Web Reverse Intel · janeeyre3007 bundle
Pre-reverse OSINT and query-expansion workflow for finding public prior cases, code, writeups, forum threads, package clues, archives, static fingerprints, and entity graph leads before hands-on website/app reverse engineering. Use before deep technical reconstruction such as AST analysis, runtime observation, browser environment analysis, JavaScript runtime emulation, or protocol validation when the target may involve request signing, encrypted parameters, anti-bot challenges, JS/WASM bundles, headers, cookies, tokens, crawler reverse engineering, device fingerprinting, captcha, GraphQL, protobuf, or mobile protocol analysis.

0 installs
▌
AI Browser Reverse · janeeyre3007 bundle
Firefox Reverse / frx-director / firefox-reverse-ai-mcp browser reverse workflow. Use when the user explicitly wants AI-driven browser reverse engineering through firefox-reverse-ai-mcp, frx-director-mcp, Firefox Reverse, or asks to choose between worker delegation and direct-drive browser engine tools. On activation, ask the user to choose the mode with the question tool unless the mode is already specified. Can coordinate with advanced reverse skills by full handoff or by loading their methodology while Firefox Reverse remains the execution engine. Do not trigger for WeChat miniapp debugging, pure AST deobfuscation, browser hook snippets only, Node/vm environment patching only, compact Python+iv8 scripts, or complete browser-free protocol collector implementation.

0 installs
▌
Camoufox JS Reverse · janeeyre3007 bundle
Node.js / Python 接口自动化与签名还原。使用 Camoufox 反检测浏览器做指纹基准、动态调试和静态源码分析，定位并还原前端加密/签名逻辑。适合 Web API sign/token/header/cookie 入口定位、JSVMP 保护分析、浏览器环境读取证据采样和签名算法复现。已有真实请求、调用栈、签名公式、固定输入输出或响应样本，且目标变成实现协议脚本时转 web-protocol-recovery 快路径。不要用于：微信小程序逆向（转 wechat-miniapp-reverse）、只要浏览器 hook 脚本（转 browser-hook-snippets）、AST 解混淆（转 ast-deobfuscate）、通用 Node.js 补环境（转 env-patch）、Python+iv8 请求脚本（转 iv8-web-reverse）、完整协议恢复（转 web-protocol-recovery）。瑞数/Ruishu/Rivers 任务按目标分流：入口定位留本 skill；Node/VM runner 或 proxy 跑通转 env-patch；iv8/suffix 转 iv8-web-reverse；完整采集器转 web-protocol-recovery。

0 installs
▌
Browser Hook Snippets · janeeyre3007 bundle
生成浏览器 DevTools Console / Snippets 可直接粘贴执行的观察型 hook 脚本。追踪 cookie、XHR、fetch、header、storage、WebCrypto、canvas、Worker、Blob、DOM 注入等动态行为。适合用户已知观察目标、只缺可执行脚本时。默认最小侵入、页面层观察。当需要验证hook效果或定位脚本位置时，MCP使用策略：优先 cloakbrowser-reverse-mcp（启动脚本 E:\\BaiduNetdiskDownload\\JS逆向2622期\\JS逆向17 webpack打包方式 - 2-2026-6-3-顾安\\2026_6_3_webpack - 2\\2026_6_3_webpack - 2\\CloakBrowser\\cloakbrowser-reverse-mcp\\launch.bat，含 CDP/SourceMap/Profiler/WebSocket/Hook 能力）；只有需要 Camoufox 引擎级指纹/属性追踪证据时转 camoufox-js-reverse。不适合：不知道要hook什么，需要先定位函数位置（转 camoufox-js-reverse）、要脱离浏览器在 Node.js 跑（转 env-patch）、要 Python + iv8 脚本（转 iv8-web-reverse）。

0 installs
▌
Web Protocol Recovery · janeeyre3007 bundle
Reverse hostile web clients into pure-protocol Python collectors. Use when the goal is end-to-end browser-free protocol recovery: sign/cookie/challenge/bootstrap/WASM/font decode/transport wrapper/WebSocket/GraphQL/protobuf/response decode, or when upstream evidence already includes real requests, call stacks, signer formulas, fixed input-output samples, or response samples and the user asks to implement replay code. Do not trigger for single-point work: only locate sign/token/header entry (camoufox-js-reverse), only generate browser hook snippets (browser-hook-snippets), Node.js/vm environment patching (env-patch), AST deobfuscation (ast-deobfuscate), compact Python+iv8 scripts (iv8-web-reverse), or WeChat miniapp runtime debugging (wechat-miniapp-reverse).

0 installs
▌
Wechat Miniapp Reverse · janeeyre3007 bundle
【优先级：微信小程序任务必选】微信小程序 / WeChat Mini Program / WMPF 逆向调试。强触发关键词：微信小程序、PC微信小程序、WMPF、WeChatAppEx、AppService、WebView、127.0.0.1:62000、WMPFDebugger、小程序调试。使用 miniapp-reverse-mcp 通过 CDP 调试端口分析小程序网络请求、源码、断点、调用栈和加密参数入口。不要被 camoufox-js-reverse 抢占。不要用于：普通 Web API 签名（转 camoufox-js-reverse 或 web-protocol-recovery）、浏览器 hook 脚本、Node.js 补环境、iv8 请求脚本、AST 解混淆或瑞数骨架任务。

0 installs

14 published skills