Borrowing it
Nothing to install: this file belongs to zhaji2333/CkSKILLS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zhaji2333/CkSKILLS/main/.agents/skills/recon-js-analysis/SKILL.mdgit clone --depth 1 https://github.com/zhaji2333/CkSKILLSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zhaji2333/ckskills/recon-js-analysis)<a href="https://agentmods.dev/skills/zhaji2333/ckskills/recon-js-analysis"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/recon-js-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zhaji2333/ckskills/recon-js-analysis"><img src="https://agentmods.dev/badge/skills/zhaji2333/ckskills/recon-js-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.02330 |
| Opus 5 | $0.00050 | $0.01165 |
| Sonnet 5 | $0.00020 | $0.00466 |
| Haiku 4.5 | $0.00010 | $0.00233 |
Grade A, and why
recon-js-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
recon-js-analysis — 资产测绘与前端 JS 深度分析
何时调用（触发条件）
- 开始测试新目标，攻击面不清晰
- 需要提取 API 端点、参数结构、鉴权逻辑、隐藏功能
- 需要还原 webpack chunk / source map / 混淆代码
- 需要找硬编码密钥、AK/SK、内部域名、测试账号
- 需要发现、历史资产、旧版本接口
- 需要确定高价值入口点（用户中心/支付/后台/API）
一、资产测绘与信息收集
端口服务：nmap / masscan / 云资产API
目录扫描：dirsearch / ffuf / 403绕过
JS分析：LinkFinder / SecretFinder / API端点提取
APP逆向：jadx / frida / 抓包分析隐藏接口
二、信息收集要"脏"（历史与周边）
必须尝试的信息源：
- Wayback Machine：翻旧版本页面/JS（可能有已删除的接口和功能）
- GitHub/GitLab搜索：目标域名、内部接口、泄露的密钥/配置
- Google Dork：site:target.com filetype:pdf/xls/doc/sql/log/bak
- 证书透明度日志：发现隐藏的子域名
- 招聘JD：推断技术栈（用了什么框架→对应什么已知漏洞）
- JS中的注释/TODO：开发者留下的线索
- robots.txt / sitemap.xml：暴露的隐藏路径
- 前端source map：还原完整前端源码
- APK/IPA反编译：提取硬编码的接口和密钥
- 更新日志/Changelog：新功能=新攻击面
三、JS 分析方法论（必须吃透再动手）
原则：JS不吃透，不发包。
3.1 完整还原
- webpack chunk拆解、source map还原（如有）
- 自动化工具：Packer-InfoFinder（开源 webpack 资产提取工具，可自动发现 JS、拆解 chunk、提取接口与敏感信息）
# 单目标扫描（自动发现JS、拆解chunk、提取接口和敏感信息）
python Packer-InfoFinder.py -u https://target.com --finder
# 批量扫描
python Packer-InfoFinder.py -l urls.txt --finder
# 指定JS文件分析（跳过HTML入口，直接分析JS）
python Packer-InfoFinder.py -j "https://target.com/app.js,https://target.com/chunk.js"
# 无头浏览器模式（捕获动态加载的JS）
python Packer-InfoFinder.py -u https://target.com --browser --finder
# 带代理扫描
python Packer-InfoFinder.py -u https://target.com --finder -p http://127.0.0.1:7890
- 格式化/美化混淆代码，逐模块阅读
- 优先定位：路由定义、API调用、请求拦截器、响应处理器
3.2 必须提取的信息
- 所有API端点（包括注释掉的、条件判断里的、环境变量控制的）
- 请求参数结构（必填/选填/隐藏参数/调试参数）
- 鉴权机制（token生成逻辑、签名算法、加密方式、刷新机制）
- 前端路由表（React Router / Vue Router / Angular Routes）
- 角色/权限判断逻辑（哪些功能对哪些角色开放）
- 硬编码的密钥、AK/SK、内部域名、测试账号
- URL / IP / 域名清单（webpack/app.js/抓包/反编译中所有请求地址）：API 网关、后台/管理端域名、CDN/OSS 存储桶、内网 IP、云服务端点、第三方回调地址——每一条都是可扩展攻击面，单独列出并进入资产测绘流程
- appid / appkey / AppSecret / 推送密钥等应用凭证：单独列出，作为重点深挖对象（见 3.3）
- Feature Flag / Debug开关 / 环境判断（dev/test/prod）
- WebSocket端点和消息格式
- 错误处理逻辑（哪些错误会泄露信息）
3.3 资产扩展与凭证上报（提取后必须做）
① URL/IP/域名 → 资产扩展（可扩展分析内容）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +1 lines 9ebc542cf9ff
- 10d ago First seen · 149 lines · 100 tokens per session scan A f286e346bf56
recon-js-analysis is a skill published in the GitHub repository zhaji2333/CkSKILLS (80 stars, last pushed 9d ago), licensed MIT. It adds 100 tokens to every session and 2,330 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
new
Create a new project to start development quickly.
channel-manager
Configure IM platform channels (Feishu, WeCom, Weixin, Discord, Telegram, DingTalk) for openclacky. Uses browser automation for navigation; guides the user to paste credentials and perform UI steps. Trigger on: "channel setup", "setup feishu", "setup wecom", "setup weixin", "setup wechat", "setup discord", "setup…
yida-data-management
A tool for querying, adding, and updating Yida form records, child tables, process records, and task-center data. It keeps ordinary forms and approval workflows on their separate data interfaces.
yida-canvas-data-binding
A method for connecting a YidaCodeCanvas page to real data from Yida forms, connectors, or same-site APIs. YidaCodeCanvas is the component used to run custom React pages inside Yida.
yida-connector-safe-actions
A method for turning existing API definitions into callable actions in an existing Yida HTTP connector. It reads frontend API wrappers and backend controller definitions to determine the request details.
yida-get-schema
A command for reading the field IDs, subtable paths, and behavior settings of a Yida form. Yida is a platform for building online forms and business workflows.