Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add Crain99/cocos-reverse-engineering-skill/plugin install cocos-reverse-engineeringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/crain99/cocos-reverse-engineering-skill/find-jsc-key)<a href="https://agentmods.dev/commands/crain99/cocos-reverse-engineering-skill/find-jsc-key"><img src="https://agentmods.dev/badge/commands/crain99/cocos-reverse-engineering-skill/find-jsc-key.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.00631 |
| Opus 5 | $0.00010 | $0.00316 |
| Sonnet 5 | $0.00004 | $0.00126 |
| Haiku 4.5 | $0.00002 | $0.00063 |
Grade A, and why
find-jsc-key scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/find-jsc-key
Search a Cocos Creator build for the XXTEA key used to encrypt its .jsc scripts. This is a focused lookup — use /reverse-cocos for the full workflow.
Instructions
Step 1: Get the target
If the user passed a path, use it. Otherwise ask.
Step 2: Run the key finder
bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/find-jsc-key.sh <path>
It searches:
- 2.x builds:
main.js,src/main.jsforxxteaKey,encryptKey,XXTEA_KEY, and literal UUID-shaped strings. - 3.x builds:
src/settings.json(assets.encrypted),application.js,cocos-js/bundled scripts. - Byte-array keys:
[0x61, 0x62, ...]style definitions — the script reconstructs them into strings.
Output is one or more KEY=<value> lines on stdout. Non-KEY= lines are diagnostic.
Step 3: If no key found
Candidates aren't always obvious. Ask the user:
- Whether they've seen the key in any developer-shipped docs or SDK strings.
- Whether the game uses a native XXTEA wrapper (look for
jsb_xxteareferences — in that case the key may be inside the native binary, which is out of scope for this text-based lookup). - Try
grep -rE '[0-9a-f]{8}-[0-9a-f]{4}' <path>/main.js <path>/src/— sometimes the key is a bare UUID literal not matched by the main patterns. Show the user the candidates and let them pick.
Step 4: Verify the key
If a KEY= was produced, verify it by decrypting one .jsc file:
bash ${CLAUDE_PLUGIN_ROOT}/skills/cocos-reverse-engineering/scripts/unpack-cocos.sh --scripts-only -k <key> -o /tmp/cc-verify <path>
Then read a few lines from one of the recovered .js files under /tmp/cc-verify/assets/Scripts/. If it looks like valid JavaScript (not random bytes), the key is correct.
Step 5: Pass the key onward
Print the key back to the user in a clearly labelled block so they can copy it, and suggest:
Now run
/reverse-cocos <path>— the key will be picked up automatically, or you can pass-k <key>to the unpack script directly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 54 lines · 19 tokens per session scan A cfd1c8aa3f6b
find-jsc-key is a command published in the GitHub repository Crain99/cocos-reverse-engineering-skill (37 stars, last pushed 4mo ago), licensed MIT. It adds 19 tokens to every session and 631 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
sim
Run the EmbodiedGen simulation rendering workflow with sim-cli.
cert-check
Review the current state against certification and platform compliance expectations.
combat-design
Design or revise combat rules, variables, readability, and tuning direction.
ui-flow-review
Review menus, HUD, navigation, and player flow from a UX perspective.
status
Show 3d-design team status and recent activity.
unity-optimize
Profile and optimize performance — uses MCP profiler for frame timing, memory, rendering stats. Identifies bottlenecks and applies fixes.