Reverse-engineer JavaScript obfuscation and API signatures

This skill reverse-engineers how a web application signs or encrypts its API requests, following five ordered phases: Observe (identify the target request, its initiator, and candidate scripts without guessing), Capture (minimally invasive runtime sampling of parameters and call order, preferring a breakpoint-on-XHR and lightweight script evaluation over heavy breakpoints), Rebuild (turn page evidence into an iterable local Node reproduction), Patch (fix environment gaps one minimal, error-driven decision at a time, retesting after each patch, never speculatively stubbing window, document, navigator, crypto, or storage), and DeepDive (deobfuscation and control-flow recovery, only when the algorithm needs long-term reuse rather than a one-off signature).

Use it to understand how a web app signs or encrypts API requests, to observe a page's request chain and script sources, to capture function arguments and return values at runtime, to trace an XHR, Fetch, or WebSocket call's trigger point, or to bring page evidence back to Node for local reproduction. If the target is a binary, APK, PE, ELF, DLL, or SO file instead, use the ida-reverse, radare2, or reverse-engineering skill instead. It requires explicit target confirmation and written authorization before any active probing step.

Input is a live web page and its network traffic. The core tool surface - listing scripts, reading script source, searching source text, breaking on XHR, evaluating scripts, reading paused-frame state, setting text-based breakpoints, listing network requests, tracing a request's initiator, reading WebSocket messages, and page/frame navigation - drives observation and capture. jshookmcp acts as an enhanced execution surface for the same workflow, offering stronger browser automation, CDP debugging, JS hooking, network interception, SourceMap rebuilding, and AST-assisted understanding, and must be registered and enabled as an MCP server before use. Output is a working local Node reproduction of the target signing or encryption logic, with each patch decision and its supporting evidence logged to a task artifact.

The skill depends on its own js-reverse MCP tool surface plus jshookmcp for deeper browser, CDP, and hook capability; both are MCP servers that need explicit registration in the client (Claude, Codex, or similar) before their tools become callable. anything-analyzer is a complementary MCP focused more on packet capture and HTTP-level analysis, useful alongside this skill rather than instead of it.

Reverse engineers and security researchers who need to recover a web app's client-side signing or encryption logic and validate it with a working local reproduction, rather than guessing at the algorithm from static reading alone.