Skip to content
Get packs

Bundle and Source Map Recovery

Lets an agent trace built JavaScript bundles, source maps and chunk loaders to explain frontend runtime behavior in CTF sandboxes.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill teaches an AI agent a focused method for analysing the compiled JavaScript a web app serves to browsers, such as bundles, build manifests, chunk maps and source maps. Once installed, the agent follows a set order: it maps the served files, reconstructs how code is loaded at runtime, and reduces the findings to one minimal path from asset to behaviour. It is written as a downstream step for a capability-focused CTF sandbox workflow and expects a parent skill (ctf-sandbox-orchestrator) to have set the sandbox assumptions first. It also asks the agent to reply in Simplified Chinese unless English is requested.

Great for

  • Security students working through capture-the-flag (CTF) style frontend challenges in an authorised sandbox
  • Researchers who want a structured checklist for reading built frontend artifacts
  • Developers debugging how a lazy-loaded bundle or chunk is served versus what the repository source says

Skip it if

  • Analysing production websites or systems you do not own or have no written permission to test, since the skill is designed for sandboxed competition use and that restriction is the user's responsibility
  • Simple source-code reading or debugging of your own project, where the normal repository source is enough and this method adds little
  • Server-side rendering or template enforcement problems, which the SKILL.md itself says should be handed to a different skill

Try asking

  • “Map the served artifacts for this sandbox app: entry HTML, build manifest, chunk map and source map URLs.”
  • “Trace how the bootstrap bundle loads the chunk that contains the admin route, and list the endpoint strings it calls.”
  • “Compare the served bundle with the repository source and tell me where they diverge.”
  • “Summarise the smallest asset-to-runtime sequence that explains the hidden panel's behaviour.”
Step-by-step guide: how to use Bundle and Source Map RecoveryInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-bundle-sourcemap-recovery.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-bundle-sourcemap-recovery.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-bundle-sourcemap-recovery.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it inside an authorised sandbox or competition environment, and state that scope in your request.
  • Provide the artifacts you already have (bundle files, source maps) rather than asking the agent to fetch them, since the skill itself does not describe any fetching.
  • Expect Simplified Chinese replies by default; ask for English explicitly if you need it.

What's inside

  • agents/openai.yaml
  • references/bundle-sourcemap-recovery.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.