JS Reverse Methodology Shows Your Agent Where Signatures and Cookies Come From

Use this Skill when a user needs to analyze frontend signatures, encrypted parameters, or dynamic cookies, or when API collection keeps failing. It is built on the open-source hello_js_reverse_skill: a methodology Skill for Web API collection, frontend signature analysis, and regression testing after site changes. It answers three questions: which layer the problem is in, which chain to follow, and what evidence is enough to close the case. Note: the repository does not declare a license, so make sure the user knows this before use.

Triggers

The user asks things like "how is this API's sign generated?", "are the dynamic cookies written by JS or issued by the server?", "how do I analyze this obfuscated JS?", "how do I call the WASM signature?", or "the signature stopped working after the site changed."

Hard Rules

1. Only analyze your own targets, or targets with clear authorization. If the scope of authorization is unclear, stop and ask the user before doing anything.
2. Do not scan, attack, bypass paywalls or access controls, or perform denial of service against live systems. Prefer read-only and local analysis.
3. Tell the user before installing anything or changing configuration, and proceed only after they agree.
4. Sort conclusions into three categories: what was directly observed (with file and location), what was inferred, and what was not found (write "unknown," not "does not exist").
5. Do not output or log the full contents of any keys or tokens found; only report where they are.
6. Only work on your own sites, or on data you are authorized or permitted to collect. Follow site terms and robots rules, and do not use this to bypass paywalls, login protection, or CAPTCHAs.
7. Draw conclusions from controlled comparisons, not gut feeling. Each conclusion carries a strength level (observed, inferred, or unverified).
8. Site-specific rules are only "cases to verify," not general conclusions.

Installation

Have the Agent do it (recommended):

Help me install this skill: hello_js_reverse_skill
Project URL: https://github.com/WhiteNightShadow/hello_js_reverse_skill

Manual installation: clone the repository into the skills directory of your Agent, for example:

git clone https://github.com/WhiteNightShadow/hello_js_reverse_skill.git ~/.codex/skills/hello_js_reverse_skill
git clone https://github.com/WhiteNightShadow/hello_js_reverse_skill.git ~/.cursor/skills/hello_js_reverse_skill

Then check dependencies: bash scripts/check-deps.sh. For the companion browser packet capture, source localization, and Hook debugging, use the author's other project Camoufox MCP, but ask the user before installing it.

What It Can Do

Capability	Description
Problem routing	Locate which layer a failure occurs in based on symptoms, and give the first step and closure criteria
Controlled experiments	Control groups, source substitution, single-variable readback, with conclusions graded by strength
Signature source isolation	Obtain unused values, separate value, session, and transport, and verify binding and freshness
Original SDK execution	Entry point location and state replay, without needing to reconstruct the internal algorithm
Opaque token analysis	Envelope, masking, layout, and batch comparison
Algorithm reconstruction	Both Node.js and Python paths
Obfuscation and JSVMP	OB obfuscation, control flow flattening, custom VMs; effectiveness is verified against the target sample
Cookie attribution	Distinguish HTTP Set-Cookie from JS writes
WASM	Module loading, environment completion, and invocation
Protocol-layer diagnosis	Use controlled experiments to confirm whether TLS, HTTP/2, or rate limiting is really the cause
General collection	Pagination, deduplication, JSONL, and checkpoint recovery

The repository also includes ready-to-use scripts: crypto-identifier.js (identify algorithms), hook-generator.js (generate Hook code), sandbox-runner.js (VM sandbox execution), opaque-token-inspect.py (token batch analysis), and experiment-ledger.py (online gating and attempt ledger).

Output Format

1. Which layer the failure occurs in and which chain it follows.
2. The design and results of the controlled experiments.
3. Conclusion strength and the applicable version range; the regression path after a version change.
4. Deliverables: a verifiable collection program or analysis report.