hellodqy/mastermind-bug-bounty/js-analysis
Claude Code and agent skill by hellodqy/mastermind-bug-bounty
Trust tier 3
- community
Source check pending
Checking that the SKILL.md file is still in the repository.
Extract client-side attack surface from JS and sourcemaps without dictating the order of investigation.
Install
npx vskill@latest install hellodqy/mastermind-bug-bounty/js-analysisSKILL.md
JS Analysis
Goal
从前端代码里恢复真实业务接口、参数、认证入口、路由、状态管理和隐藏功能，为后续攻击面分析提供结构化材料。
Tools / Inputs
- JS、sourcemap、HTML、Network 请求、SPA 路由、localStorage/sessionStorage
- 输出：
_endpoint_params.json、_login_links.json、_secrets_found.json - 资源索引：
references/INDEX.md；候选资源：js-analysis-vulnforge.md、vue-spa-attacks.md
Constraints
- 必须落盘并结构化输出，不能只口头总结。
- 提取粒度到 method、Content-Type、参数、auth、source file。
- 登录入口必须单独记录。
- 不把前端鉴权当后端鉴权。
- 发现新路由/chunk 后追加为新攻击面。
Chain Questions
- 这个接口需要什么参数，参数值能从哪里来？
- 这个路由或 meta.auth 是否只在前端控制？
- Store 里有没有 token、角色、菜单、权限、用户标识？
- sourcemap 是否暴露源码、注释、内部 API 或 key？
- 新发现能否喂给 data linkage、JWT、bypass 或 exploit？
Security
- Security scanPassed, 90 of 100Pattern checks on the skill's files.
- Model reviewPassed
Quality evaluation
- Task evaluationNot runNo evaluation yet. Run one in Skill Studio.
Source
- SKILL.md in the repositoryCheckingskills/js_analysis/SKILL.md
Popularity
- 7-day trend score
- 5
Not refreshed yet.
Works with
Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.
- Claude Code
- Cursor
- GitHub Copilot
- Windsurf
- Codex
- Gemini CLI
- Cline
- Amp
- Roo Code
- Goose
- Continue
- Kilo Code
- Junie
- Trae
- OpenHands
- Qwen Code
- AI Agent
- Tabnine Chat
- Sourcegraph Cody
- Amazon Q
- Firebase Genkit
- Sweep
- Devin
- Phind
- Mentat
- Claude Desktop
- Aider
- GPT Pilot
- Plandex
- bolt.new
- v0
- Replit Agent
- Anse
- TypingMind
- BetterChatGPT
- LibreChat
- Warp AI
- Pieces
- Fig AI
Embed badge
[](https://verified-skill.com/skills/hellodqy/mastermind-bug-bounty/js-analysis)