js-reverse
在使用 js-reverse-mcp 做前端 JavaScript 逆向时使用，适用于签名链路定位、页面观察取证、运行时采样、本地补环境复现与证据化输出。优先适配当前环境里的 js-reverse_* 工具，需要更强的浏览器/CDP/Hook 面时联动 jshookmcp。
61
71%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
Fix and improve this skill with Tessl
tessl review fix ./skills/js-reverse/SKILL.mdSecurity
1 medium severity finding. This skill can be installed but you should review these findings before use.
W013: Attempt to modify system services in skill instructions.
What this means
The skill prompts the agent to compromise the security or integrity of the user’s machine by modifying system-level services or configurations, such as obtaining elevated privileges, altering startup scripts, or changing system-wide settings.
Why it was flagged
It instructs running bootstrap PowerShell scripts that install software (Node via winget), register/start MCP services and clone/install dependencies — actions that modify the host system state and may require elevated privileges.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
在工作流 Observe 阶段会通过 `js-reverse_navigate_page` 打开“目标页面”、再用 `js-reverse_list_network_requests` / `js-reverse_get_request_initiator` / `js-reverse_list_scripts` / `js-reverse_search_in_sources` 读取页面侧由外部站点（用户可选择/提交的目标 URL）产生的网络请求、脚本与源码文本，从而让 LLM 在运行时消费外部站点作者的自由文本。
- Repository
- zhaoxuya520/reverse-skill
- Commit
3ae5c59
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.