JS Reverse Automation Gathers Evidence in a Real Browser and Hands Over Working Calls

Use this Skill when a user needs to locate front-end encryption functions (login passwords, request signatures, form fields, response decryption) and wants the results packaged as reusable services that connect to Burp. The underlying tool is the open-source js-reverse-automation--skill (Apache-2.0): it connects to a real browser via chrome-devtools-mcp, automatically locates encryption entry points, and generates JSRPC injection code, a Flask proxy, and Burp autoDecoder integration documentation.

Triggers

The user asks things like "How is this login password encrypted?", "Where do the sign / token / enc values in the request come from?", "Wrap this encryption logic into an API", or "Connect it to Burp for automatic encryption and decryption."

Hard Rules

1. Only analyze your own targets, or targets with explicit authorization. If the scope of authorization is unclear, stop and ask the user before doing anything.
2. Do not scan, attack, bypass payment or access controls, or perform denial of service against live systems. Prioritize read-only and local analysis.
3. Tell the user before installing anything or changing configuration, and proceed only after they agree.
4. Classify conclusions into three categories: what was directly observed (with file and location), what was inferred, and what was not found (write "unknown", not "does not exist").
5. Do not output or log the full contents of any keys or tokens found; only report where they are.
6. Only work on your own sites or authorized test targets. Target addresses and parameters are provided by the user; do not find targets yourself.
7. Always shut down the JSRPC and Flask services when finished, following the instructions in the output, and do not leave them running in the background.
8. When you encounter anti-debugging, anti-hooking, JSVMP or other countermeasure signals, observe before intervening: run the countermeasure runtime probe first, and enter intervention mode or source instrumentation only when there is a clear signal.

Installation

1. Install the Python dependencies in the Skill directory:

python3 -m pip install -r requirements.txt

2. Install the browser MCP (choose the line for your Agent, and ask the user before installing):

claude mcp add chrome-devtools -- npx -y chrome-devtools-mcp@latest    # Claude Code
codex mcp add chrome-devtools -- npx -y chrome-devtools-mcp@latest     # Codex
gemini mcp add chrome-devtools npx -y chrome-devtools-mcp@latest       # Gemini

3. Place the js-reverse-automation directory from the repository into the Agent's Skill directory.

Input Format

Target URL: https://目标地址/login
Parameters To Analyze: password
Optional Fetch Example: fetch("https://目标地址/api/login", {"body":"...","method":"POST"})

For the first use, it is recommended to include the jsrpc path, which makes the later workflow more stable.

Workflow (Phases 0 to 9)

1. Pre-analyze the Fetch example (if provided): extract the algorithm, parameter format, and target address.
2. Open the page, inject hooks, and trigger the target action.
3. Capture network requests and locate the encryption function (score candidates across 8 dimensions, then verify with real samples and differential testing).
4. Register JSRPC, generate the Flask proxy and Burp artifacts.
5. Verify and output in the standard format.

The first run generates an artifacts folder containing evidence diagrams, encryption candidate scores, a four-layer verification report, JSRPC and Flask status, and browser forensics acceptance files. It uses analysis_result.json as the contract between stages.

Output Format

1. Plaintext, ciphertext or signature, final request, and server response.
2. JSRPC injection code, Flask proxy, and Burp autoDecoder configuration.
3. Verification report, including which checks did not pass.
4. Reminder to the user: verify validity first, then configure Burp, and finally shut down JSRPC and Flask.