How to use the js-reverse agent skill for front-end JS analysis

What the skill makes the agent do

An agent skill is a folder with a SKILL.md file and supporting reference notes. When a task matches the skill's description, the agent reads these instructions and follows them. The js-reverse skill does not add new browser abilities on its own. It gives the agent a method for using the browser tools it already has, called js-reverse_* MCP tools, or the optional jshookmcp server.

The method has five stages: Observe (find the target request, its initiator and likely scripts), Capture (take small runtime samples, such as breaking on an XHR or reading paused values), Rebuild (turn page evidence into a Node.js reproduction), Patch (fill missing environment pieces one at a time, re-running after each change) and DeepDive (deobfuscate only when the algorithm must be reused long term).

The skill also sets rules: observe the page before guessing, prefer hooks over breakpoints, record evidence for every step, and do not patch browser objects that the page evidence does not show are needed.

Install the js-reverse skill with a ZIP download

Download the skill ZIP from this page and unzip it. You have two options for where the folder goes. For a personal setup for all projects, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Claude Code reads skills from these locations.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

• Personal install: ~/.claude/skills/js-reverse/
• Project install: <your-project>/.claude/skills/js-reverse/
• Claude apps: Settings → Capabilities → Skills → upload the ZIP

Set up the MCP tools the skill calls

The skill assumes js-reverse_* MCP tools are available in your client. It refers to these tools by name, for example js-reverse_new_page, js-reverse_list_network_requests and js-reverse_break_on_xhr. If these tools are not present, the skill tells the agent to run its bootstrap rather than guess paths.

jshookmcp is optional. It is an npm package, @jshookmcp/jshook, that you must download, register in your MCP client configuration and enable. The skill says it is an enhanced execution layer for browser automation, CDP debugging, JS hooks, network interception, SourceMap reconstruction and AST analysis. Registration is not automatic in the sense that the skill does not change client settings unless you ask for it.

The bundled bootstrap script can install and register jshookmcp. You choose the client explicitly. If you omit the host target, the script only prepares the capability and does not edit Claude or Codex configuration.

• Required: js-reverse_* MCP tools available in the client
• Optional: jshookmcp (@jshookmcp/jshook) registered and enabled in the MCP client config
• Optional: anything-analyzer MCP server on port 23816, which needs pnpm and the project source
• Node.js 22 is needed; the bootstrap installs it with winget if it is missing

Trigger the skill with natural requests

You do not need to name the skill for it to be considered. The skill applies to front-end JavaScript reverse engineering tasks such as locating a request signature, tracing which script fires an XHR or fetch call, capturing function inputs and outputs at runtime, or moving page evidence into Node.js for local reproduction.

If your request mentions jshookmcp, JS hooks, CDP, browser breakpoints, network interception, SourceMap or AST deobfuscation, the agent still uses this skill and switches the underlying tools to jshookmcp.

• Find which script generates the sign parameter on this login request.
• Trace what calls the XHR to the /api/order endpoint on a site I own, and capture its arguments.
• Reproduce this page's encryption function in Node.js so I can call the API from my test suite.
• Audit the client-side risk-control fields on my staging site and record evidence for each step.

Work through a typical task

A good session follows the stages in order. The agent opens the page, lists network requests, checks the call stack of the target request, narrows the script list and searches the sources for the request path or parameter name. Only then does it set a lightweight hook or breakpoint and inspect what is paused.

The skill asks the agent to keep a task record. Its template covers the target request, initiator, suspicious script, sampling method, entry function, environment gaps, each patch and whether the parameter was obtained and can be reproduced stably.

• Observe: target URL, initiator clues, suspicious script URLs
• Capture: hit location, key inputs, key return values
• Rebuild: entry function, dependent scripts, environment gaps
• Patch: first divergence, this patch, re-test result
• Output: whether the parameter was obtained, whether it reproduces, remaining risks

Safety notes: scripts and network access

The skill runs scripts and uses the network. The bootstrap script in the skill's scripts folder is a Windows PowerShell file that can install Node.js through winget, install npm packages, clone the anything-analyzer project and install its dependencies with pnpm. Read the script before running it, and only run it on a machine where you accept those installs.

The skill is written for authorised work. It opens a precedent note that assumes the operations are approved. Use it only on sites you own or have written permission to test. Using it against third-party services can breach their terms or the law.

The skill does not cover binary files. For APK, PE, ELF, DLL or SO targets it redirects to other reverse-engineering skills such as ida-reverse, radare2 or reverse-engineering.

• Run the bootstrap script only after reading it
• Use only on sites you own or are authorised to test
• Binary targets go to other skills