Analyze js

Skill xrip/claude-skill-analyze-js/.claude/skills/analyze-js

A Claude Code skill that performs static analysis on JavaScript files to find API endpoints, URLs, secrets, emails, and file references. Supports TOON format output (50% smaller than JSON) optimized for LLM consumption. Use with /analyze-js in Claude Code.From the repository description

Install

npx -y skills add xrip/claude-skill-analyze-js --skill analyze-js

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

9 stars9 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 2 commands, including `npx js-analyzer-cli [OPTIONS] <paths...>` and 1 more.

SKILL.md

2.2 KB, 617 tokens by cl100k_base, as published. Nobody here has run it

name: analyze-js description: Analyze JavaScript files for API endpoints, secrets, URLs, emails, sensitive files, and bundler versions examples:

analyze-js bundle.js
analyze-js src/
analyze-js --verbose dist/

JS Analyzer Skill

Analyzes JavaScript files for security-relevant information using npx js-analyzer-cli. Works in any project without installation.

Command

npx js-analyzer-cli [OPTIONS] <paths...>

Detection Categories

endpoints: REST APIs, GraphQL, OAuth, admin panels
urls: External links, cloud storage, WebSockets
secrets: API keys, tokens, JWT, credentials (auto-masked)
emails: Valid addresses (test emails filtered)
files: Sensitive file references (.env, configs, backups)
bundlers: Detected bundlers with versions (Webpack, Vite, Rollup, etc.)

Auto-filters noise: build artifacts, module imports, XML namespaces.

Options

--verbose - Show progress details
--format=json - JSON output (default: toon)
--pretty - Pretty print JSON
--no-recursive - Skip subdirectories

Directory Scanning

Default behavior:

Finds .js, .jsx, .mjs files
Skips node_modules/ and hidden dirs
Recursive by default

Output Format

TOON format (default) - compact, LLM-optimized:

summary:
  total: 18
  endpoints: 4
  secrets: 1
findings:
  endpoints[4	]{value	location}:
    /api/v1/users	bundle.js:42:15
    /admin/dashboard	bundle.js:234:12
  secrets[1	]{value	location}:
    AKIA...MPLE (AWS Key)	bundle.js:312:25

Location format: file:line:column (clickable in IDEs)

How to Present Results

Start with summary, highlight critical findings (secrets, admin endpoints), group by category.

Example:

📊 Analysis: bundle.js (18 findings)

🔴 Critical:
• AWS Key at bundle.js:312:25
• Admin endpoint at bundle.js:234:12

Endpoints (4): /api/v1/users (bundle.js:42:15), /admin/dashboard (bundle.js:234:12), ...
Bundler: Webpack 5.88.2

Usage Flow

Identify paths
Add flags if needed
Run: npx js-analyzer-cli [flags] <paths>
Parse and present

Note: First run downloads package (~2s), then cached.

Security

For authorized testing only: pentesting, bug bounties, own applications, security audits.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.