js-reverse

Reverse-engineer frontend JavaScript signature and encryption logic using MCP browser debugging tools.

21|8|Updated Aug 3, 2026
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill js-reverse-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: js-reverse
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/js-reverse
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill js-reverse-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Locating the exact JavaScript code that generates API signatures, encrypted parameters, and anti-bot fields on websites is slow and error-prone when done by guessing. This Skill provides a disciplined, evidence-first workflow for frontend JS reverse engineering using js-reverse-mcp and jshookmcp browser debugging tools. ## Core Features & Use Cases - Five-Phase Workflow: Observe, Capture, Rebuild, Patch, and DeepDive stages guide you from page observation to a stable local Node.js reproduction of the target algorithm. - MCP Tool Mapping: Predefined mappings to js-reverse_* tools (network request listing, XHR breakpoints, script search, runtime evaluation) plus jshookmcp for CDP debugging, JS hooks, and AST deobfuscation. - Environment Patching Discipline: Rules for minimal, evidence-driven browser environment shimming in Node.js, with first-divergence tracking and fallback strategies. - Use Case: You need to replicate a website's encrypted request signature. The Skill walks you through finding the target request, tracing its initiator call stack, breaking on the XHR, capturing runtime values, and rebuilding the signing function locally in Node. ## Quick Start Ask the AI to use the js-reverse skill to locate the signature generation logic for a target website's API request and reproduce it locally in Node.js.

Frequently Asked Questions about js-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find the JavaScript code that generates an API signature?▼

Open the target page, list network requests to find the target call, then use get_request_initiator to trace its call stack. Search script sources for the parameter name and set an XHR breakpoint to capture the signing function's inputs and outputs at runtime.

How to reproduce a website's encryption algorithm locally in Node.js?▼

First capture the real entry function, call order, and parameter sources from the live page. Then import the target script in Node, shim only the browser objects proven necessary by page evidence, and patch one minimal gap at a time until the output matches.

What is the difference between js-reverse-mcp and jshookmcp?▼

js-reverse-mcp provides the default tool surface for page observation, breakpoints, and runtime sampling. jshookmcp acts as an enhanced execution layer for heavier needs like CDP debugging, JS hooks, network interception, SourceMap reconstruction, and AST-assisted deobfuscation.

Can this skill reverse engineer APK, PE, or ELF binaries?▼

No, this skill only covers frontend JavaScript in web pages. For binaries such as APK, PE, ELF, DLL, or SO files, use dedicated skills like ida-reverse, radare2, or a general reverse-engineering skill instead.

Why does my local Node.js reproduction fail with missing browser object errors?▼

Failures happen when shimming window, document, or navigator based on guesses rather than page evidence. Only patch objects proven necessary by observed runtime behavior, apply one minimal patch at a time, and retest after each change while tracking the first divergence.