How to use the Bundle and Source Map Recovery agent skill

What an agent skill is and what this one does

An agent skill is a folder with a SKILL.md file that tells an AI agent how to approach a specific kind of task. When a request matches the skill's description, the agent loads those instructions and follows them.

This skill focuses on runtime truth in built frontend assets. It tells the agent to start from the served artifact set (entry HTML, build manifest, bootstrap bundle, chunk map and source maps), record chunk ids, route chunks, loader functions, endpoint strings and config keys, and then reconstruct the smallest runtime graph that explains which asset executes now.

• Map the served files: script tags, preload hints, manifest files, asset map, chunk registry and source map URLs.
• Reconstruct runtime structure: bootstrap code, chunk loaders, module registry and lazy import boundaries.
• Reduce findings to one minimal path: served asset, loader path, module or symbol, runtime effect.
• Keep served artifact truth separate from repository source unless parity is proven.

Install the skill from the ZIP

Download the skill ZIP from this page and unzip it. The skill folder contains agents/openai.yaml, references/bundle-sourcemap-recovery.md and SKILL.md.

For personal use, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• App install: Settings → Capabilities → Skills

Install the parent skill first

This skill is a downstream specialisation. Its SKILL.md says to use it only after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership and evidence priorities. If that has not happened, the agent should return to the parent skill first.

Install ctf-sandbox-orchestrator before you rely on this skill, following the same steps above.

Trigger the skill with natural requests

The skill's description lists the kinds of requests that should load it. You do not need special syntax. Describe what you want in plain language, and make sure your sandbox context has already been set up by the parent skill.

Requests that match the description include asking to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behaviour from built frontend artifacts.

• Reconstruct the JavaScript structure served by this sandbox app from its built files.
• Inspect the source map and chunk map and list the chunk ids and route chunks.
• Trace how the lazy-loaded bundle for the admin route gets loaded at runtime.
• Recover any hidden API endpoints that appear in the emitted assets.
• Explain what the obfuscated loader does when the page starts.

What you need before you start

You need access to the built frontend artifacts of the target sandbox, meaning the HTML, JavaScript bundles and source maps. The skill works from those files, not from the repository alone.

The optional reference file references/bundle-sourcemap-recovery.md holds the artifact checklist, deobfuscation checklist and evidence packaging notes. The skill tells the agent to load it, so keep it in the folder when you install.

• Parent skill ctf-sandbox-orchestrator installed and active
• Access to the target sandbox's HTML, JavaScript bundles and source maps
• Optional: references/bundle-sourcemap-recovery.md in the skill folder

Safety notes: scope, scripts and network

Use this skill only on systems you own or have written permission to test, within an authorised sandbox for competition work. The skill is designed for that setting, and staying within that scope is your responsibility.

According to the skill listing, it runs no scripts and uses no network access. It works from the files you provide. The skill is also not meant for simple reading of your own project's source, where normal repository source is enough, or for server-side rendering or template enforcement problems, which the SKILL.md says should go to a different skill.

• Do not point it at production websites or systems you do not have permission to test.
• Runs scripts: no. Uses network: no.
• For SSR or template enforcement problems, the skill hands work to a tighter template-render skill.

Tips for better results

Give the agent the full set of served artifacts together: entry HTML, manifest, bootstrap bundle, chunk map and source maps. The skill's workflow depends on tying filenames, hashes and route ownership together.

Ask for evidence, not just conclusions. The skill asks the agent to keep filenames, chunk ids, manifest entries, source map paths and recovered endpoints, so you can check each step.

Expect replies in Simplified Chinese unless you explicitly ask for English.

• Provide all served artifacts in one session.
• Ask for the minimal asset-to-runtime sequence, not a full dump.
• Say in your request if you want English output.