---

name: analyze-js description: Analyze JavaScript files for API endpoints, secrets, URLs, emails, sensitive files, and bundler versions examples:

• analyze-js bundle.js
• analyze-js src/
• analyze-js --verbose dist/

---

JS Analyzer Skill

Analyzes JavaScript files for security-relevant information using

npx js-analyzer-cli

. Works in any project without installation.

Command

npx js-analyzer-cli [OPTIONS] <paths...>

Detection Categories

• endpoints: REST APIs, GraphQL, OAuth, admin panels
• urls: External links, cloud storage, WebSockets
• secrets: API keys, tokens, JWT, credentials (auto-masked)
• emails: Valid addresses (test emails filtered)
• files: Sensitive file references (.env, configs, backups)
• bundlers: Detected bundlers with versions (Webpack, Vite, Rollup, etc.)

Auto-filters noise: build artifacts, module imports, XML namespaces.

Options

• --verbose

  - Show progress details

• --format=json

  - JSON output (default: toon)

• --pretty

  - Pretty print JSON

• --no-recursive

  - Skip subdirectories

Directory Scanning

Default behavior:

• Finds

  .js

  ,

  .jsx

  ,

  .mjs

  files
• Skips

  node_modules/

  and hidden dirs
• Recursive by default

Output Format

TOON format (default) - compact, LLM-optimized:

summary:
  total: 18
  endpoints: 4
  secrets: 1
findings:
  endpoints[4	]{value	location}:
    /api/v1/users	bundle.js:42:15
    /admin/dashboard	bundle.js:234:12
  secrets[1	]{value	location}:
    AKIA...MPLE (AWS Key)	bundle.js:312:25

Location format:

file:line:column

(clickable in IDEs)

How to Present Results

Start with summary, highlight critical findings (secrets, admin endpoints), group by category.

Example:

📊 Analysis: bundle.js (18 findings)

🔴 Critical:
• AWS Key at bundle.js:312:25
• Admin endpoint at bundle.js:234:12

Endpoints (4): /api/v1/users (bundle.js:42:15), /admin/dashboard (bundle.js:234:12), ...
Bundler: Webpack 5.88.2

Usage Flow

1. Identify paths
2. Add flags if needed
3. Run:

   npx js-analyzer-cli [flags] <paths>

4. Parse and present

Note: First run downloads package (~2s), then cached.

Security

For authorized testing only: pentesting, bug bounties, own applications, security audits.