What is JS Reverse Analyzer?

A general-purpose guide for examining JavaScript code to identify website encryption, request signatures, and anti-bot checks, then documenting the findings in Python.

Use it to find relevant JavaScript files, inspect encryption and signing algorithms, deobfuscate code, run analysis in a browser when needed, and produce verification examples.

It gives a structured way to understand difficult client-side request logic when the important behavior is hidden in bundled or obfuscated code.

JS Reverse Analyzer — Skill for Claude Code and Codex by sjhhh024-cmyk

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add sjhhh024-cmyk/Spider-JS-Mcp-Skills --skill skill

Clone the repo

git clone --depth 1 https://github.com/sjhhh024-cmyk/Spider-JS-Mcp-Skills

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/sjhhh024-cmyk/spider-js-mcp-skills/skill/github.svg)](https://agentmods.dev/skills/sjhhh024-cmyk/spider-js-mcp-skills/skill)

Your own site

<a href="https://agentmods.dev/skills/sjhhh024-cmyk/spider-js-mcp-skills/skill"><img src="https://agentmods.dev/badge/skills/sjhhh024-cmyk/spider-js-mcp-skills/skill/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/sjhhh024-cmyk/spider-js-mcp-skills/skill"><img src="https://agentmods.dev/badge/skills/sjhhh024-cmyk/spider-js-mcp-skills/skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 37 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,582 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00037	$0.02582
Opus 5	$0.00018	$0.01291
Sonnet 5	$0.00007	$0.00516
Haiku 4.5	$0.00004	$0.00258

Measured 12d ago against content hash 3553d5a7bf4a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

JS Reverse Analyzer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/analyze_template.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

1. 找到请求发送函数（如 `axios.post`, `fetch`）

skill/SKILL.md · 379 lines

How it starts

The opening of the file, as written. The whole thing — 379 lines — stays where its author put it; the contents beside it link to each section on GitHub.

JS 逆向分析工具（JS Reverse Analyzer）

简介

这是一个通用的 JavaScript 逆向分析工具，能够帮助分析目标网站的加密算法、签名机制和反爬策略。该工具会：

📊 识别和分析关键 JS 文件
🔍 提取加密/签名算法
📝 生成详细的逆向分析报告
🐍 提供 Python 实现代码
✅ 验证方法和使用示例

使用方法

📋 分析流程说明

本 Skill 提供完整的 JS 逆向分析流程，引导 AI 进行系统化的分析。

主要使用方式：

✅ 按照下面的步骤 1-5 进行分析（这是主要流程）
✅ 在分析过程中，根据具体情况灵活判断和调整
✅ 只在遇到技术障碍时，才调用 MCP 工具辅助

🔧 MCP 辅助工具（可选）

本 Skill 配备了 13个 MCP 辅助工具，用于突破技术限制。

何时考虑使用 MCP 工具：

🛡️ 遇到验证挑战（五秒盾、Cloudflare）→ 可用 bypass_challenge 工具绕过
🔒 JS 代码严重混淆无法阅读 → 可用 deobfuscate_code 工具反混淆
⚡ 需要浏览器环境动态执行 → 可用 analyze_with_browser 工具
🔍 不确定网站保护程度 → 可用 detect_protection 工具检测

重要提示：

MCP 工具只是辅助手段，不是主要流程
优先使用 Skill 的分析步骤，只在必要时才调用 MCP 工具
保持分析的深度和思考，不要过度依赖自动化工具

基本使用

当用户请求分析某个网站的 JS 逆向算法时：

请分析 [网站URL] 的 JS 加密算法

工作流程

按照以下步骤进行分析：

步骤 1: 页面内容获取

使用 read_url_content 工具获取目标页面的 HTML：

read_url_content(目标URL)

从 HTML 中识别加载的 JS 文件列表。

步骤 2: JS 文件分析

💡 MCP 工具提示：如果 JS 文件高度混淆难以阅读，使用 deobfuscate_code 工具先反混淆！

下载并分析识别到的关键 JS 文件：

主入口文件：通常包含路由和应用逻辑
第三方库文件：可能包含加密库（如 CryptoJS）
业务逻辑文件：包含具体的请求处理逻辑

重点查找以下关键字：

sign, signature, encrypt, decrypt
md5, sha, aes, rsa, crc
timestamp, nonce, token
headers, request, axios, fetch

步骤 3: 算法提取

从 JS 代码中提取核心算法：

常见算法类型：

MD5/SHA：哈希签名
AES/DES：对称加密
RSA：非对称加密
Base64：编码
CRC32：校验码
自定义算法：字符串拼接、位运算等

提取要点：

找到请求发送函数（如 axios.post, fetch）
追踪参数构造过程
识别签名/加密函数调用
提取算法实现代码

步骤 4: 生成分析报告

创建结构化的逆向分析报告，包含以下章节：

# [网站名称] JS 逆向分析报告

## 1. 目标网站信息
- URL、网站名称、分析时间

## 2. 关键 JS 文件识别
- 主要 JS 文件列表
- 第三方库依赖

## 3. 请求签名算法分析
- 核心代码片段
- 算法步骤说明
- 参数构造方式

## 4. 算法实现细节
- 具体算法的代码实现
- 关键常量和变量

## 5. Python 逆向实现
- 完整的 Python 代码
- 使用示例

## 6. 关键要点
- API 域名
- 签名特点
- 注意事项

## 7. 验证方法
- 浏览器调试步骤
- 验证方式

## 8. 可能的反爬措施
- User-Agent 检测
- Cookie 验证
- 频率限制
- IP 限制

## 9. 总结

步骤 5: Python 代码实现

提供完整的 Python 逆向代码，必须包含：

Read the full file on GitHub · 379 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 379 lines · 37 tokens per session scan A 3553d5a7bf4a

Subscribe to this mod's changes

JS Reverse Analyzer is a skill published in the GitHub repository sjhhh024-cmyk/Spider-JS-Mcp-Skills (10 stars, last pushed 7mo ago), licensed Apache-2.0. It adds 37 tokens to every session and 2,582 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Security javascript reverse-engineering web-scraping

wakaru

Turn minified, bundled, or transpiled JavaScript back into readable modules. Use when you encounter unreadable production JS — a webpack/esbuild/Metro/Rollup bundle, a minified vendor script, Babel/TypeScript/SWC-transpiled output, or a single mangled .js file — and need to read, audit, debug it, or recover a…

pionxzh/wakaru · 99 tokens

analyzing-malicious-pdfs

Analyzes malicious PDF documents: parsing the object structure for JavaScript, OpenAction/launch triggers, embedded files, and URIs, then extracting and decoding suspicious streams without opening the document in a reader. Activates for requests to analyze a malicious PDF, inspect PDF JavaScript, or extract embedded…

meltedinhex/analyst-ai-pack · 73 tokens

deobfuscating-malicious-javascript

Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets: unrolling string-array and char-code encodings, resolving eval/Function chains, and statically recovering payloads and URLs without executing untrusted code. Activates for requests to deobfuscate JavaScript, decode obfuscated JS, or…

meltedinhex/analyst-ai-pack · 84 tokens

JS Reverse Analyzer