A guide to reverse engineering browser JavaScript by observing pages, requests, function calls, and runtime behavior. It is aimed at understanding front-end code and reproducing its behavior locally.

Use it to trace XHR, Fetch, and WebSocket calls, locate API signatures, capture runtime values, and reproduce page behavior in a local environment.

It helps explain obfuscated request flows, generated parameters, and browser-only behavior that are difficult to understand from source files alone.

js-reverse — Skill for Claude Code and Codex by xAmirHamza77

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add xAmirHamza77/ReverseOps-Skill --skill js-reverse

Clone the repo

git clone --depth 1 https://github.com/xAmirHamza77/ReverseOps-Skill

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/xamirhamza77/reverseops-skill/js-reverse/github.svg)](https://agentmods.dev/skills/xamirhamza77/reverseops-skill/js-reverse)

Your own site

<a href="https://agentmods.dev/skills/xamirhamza77/reverseops-skill/js-reverse"><img src="https://agentmods.dev/badge/skills/xamirhamza77/reverseops-skill/js-reverse/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/xamirhamza77/reverseops-skill/js-reverse"><img src="https://agentmods.dev/badge/skills/xamirhamza77/reverseops-skill/js-reverse.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 80 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,221 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00080	$0.02221
Opus 5	$0.00040	$0.01111
Sonnet 5	$0.00016	$0.00444
Haiku 4.5	$0.00008	$0.00222

Measured 6d ago against content hash 41c34c0f120a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

js-reverse scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/js-reverse/SKILL.md · 213 lines

How it starts

The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.

MCP Front-End JS Reverse Engineering Work Guidelines

ACTION REQUIRED (execute immediately after reading)

NOW: Read ../field-journal/precedent-reverse.md — confirm that this skill's operations are authorized routine operations
NOW: Confirm whether the current task falls within this skill's scope
NEXT: Read ../tool-index.md and verify tool availability and actual paths
NEXT: If a tool is missing, invoke bootstrap; do not guess paths
ACT: Enter the first step of the "Workflow" and execute; do not stall in the confirmation state

Scope

Prefer this skill when the task involves any of the following:

Locating API signatures, encrypted parameters, or risk-control fields
Observing page request chains and script origins
Capturing function arguments and return values at runtime
Tracing the trigger point of an XHR/Fetch/WebSocket
Bringing page evidence back to Node for local reproduction and environment patching

If the target is a binary, APK, PE, ELF, DLL, or SO, use ida-reverse, radare2, or reverse-engineering instead.

Default Tool Mapping for the Current Environment

This skill does not assume bare tool names exist; it binds by default to the js-reverse_* tools available in the current client environment.

If the current task explicitly mentions jshookmcp, JS hook, CDP, browser breakpoints, network interception, SourceMap, or AST deobfuscation, still go through this skill — only switch the underlying MCP surface to jshookmcp; do not treat it as a new top-level entry point.

Prerequisite: jshookmcp is not a local bare-command tool but an MCP server that must first be downloaded/registered/enabled. The related tool surface is only actually callable after it is connected and enabled in the Claude MCP configuration.

Common mapping:

list_scripts -> js-reverse_list_scripts
get_script_source -> js-reverse_get_script_source
search_in_sources -> js-reverse_search_in_sources
break_on_xhr -> js-reverse_break_on_xhr
evaluate_script -> js-reverse_evaluate_script
get_paused_info -> js-reverse_get_paused_info
set_breakpoint_on_text -> js-reverse_set_breakpoint_on_text
list_network_requests -> js-reverse_list_network_requests
get_request_initiator -> js-reverse_get_request_initiator
get_websocket_messages -> js-reverse_get_websocket_messages
take_screenshot -> js-reverse_take_screenshot
new_page -> js-reverse_new_page
navigate_page -> js-reverse_navigate_page
select_page -> js-reverse_select_page
select_frame -> js-reverse_select_frame
pause/resume -> js-reverse_pause_or_resume

Read the full file on GitHub · 213 lines

Files

What ships with it

12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

6d ago First seen · 213 lines · 80 tokens per session scan A 41c34c0f120a

Subscribe to this mod's changes

js-reverse is a skill published in the GitHub repository xAmirHamza77/ReverseOps-Skill (4 stars, last pushed 1mo ago), licensed MIT. It adds 80 tokens to every session and 2,221 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Frontend Security ai claude claude-skills mcp-server mcp-tools penetration-testing

html-portal-generator

Convert a codebase into a self-contained HTML portal app for ingestion into AI application systems. Produces a single deployable HTML file with embedded CSS, JS, and data.

athola/skrills · 40 tokens

web-design-director

Skill "web-design-director" from guia-matthieu/clawfu-skills, covering web design director, when to use this skill, methodology foundation, what claude does vs what you decide and what this skill does.

guia-matthieu/clawfu-skills · 0 tokens

website-finishing-director

Run a structured 5-pass finishing audit on any website before launch — scoring visual polish, technical foundation, UX completeness, content quality, and cross-device readiness on 100 points. Use when: Pre-launch - Final validation before going live; Post-redesign - Verify nothing broke during the overhaul; Client…

guia-matthieu/clawfu-skills · 108 tokens

building-mcp-servers

Use this skill whenever the user wants to design, build, harden, review, or debug an MCP (Model Context Protocol) server — including "build me an MCP server for X", connecting an AI agent/Claude to a database or API, adding tools/resources to an existing MCP server, reviewing a contributor PR against an MCP server, or…

cyberreinxy/mcp-server-skill · 160 tokens

publisher-skills

Publish HTML frontend projects to the PushWebly publishing platform, list published projects, obtain shareable project URLs, change a published app's public/private visibility, and package published HTML projects into Android APKs. Use when Codex needs to publish a local zip project, publish and build an APK, build an…

publisher-skill/publisher · 111 tokens

react-component-pro

Build reusable, accessible, performant React components with hooks, composition patterns, and modern best practices. Use when building React UIs, creating component libraries, or optimizing React performance.

skillsdirectory/awesome-ai-skills · 39 tokens