---
name: advanced-javascript-surface-analysis
description: Analyze authorized JavaScript bundles, source maps, HTML, HAR files, and local captures for reachable browser and API trust boundaries.
---

# Advanced JavaScript surface analysis

Use this skill only for code and traffic obtained from an authorized target. Do not publish or retain unnecessary secrets, personal data, or private source.

## Accepted inputs

- Local JavaScript, TypeScript, HTML, source-map, HAR, JSON, or text folders
- Explicit bundle URLs inside current scope
- Read-only proxy history exported from Burp or another approved tool
- Framework build manifests and chunk maps
- A current scope record and stop conditions

## Output artifacts

```text
js-map/
  inventory.json
  endpoints.json
  operations.json
  sources.json
  browser-trust.json
  secrets-review.json
  leads.json
  dead-ends.json
```

Every artifact includes source path or URL, content hash, retrieval time, line or byte location when available, confidence, and analyst notes.

## Procedure

### 1. Inventory without executing target code

- Hash and deduplicate files before analysis.
- Detect minified, bundled, module, worker, service-worker, source-map, WebAssembly, and generated files.
- Recover chunk names and lazy routes from framework manifests.
- Record source-map references but fetch only in-scope URLs.
- Never evaluate untrusted bundles with `eval`, a browser profile containing real credentials, or the analyst's host privileges.

### 2. Recover structure

Prefer an AST parser appropriate to the syntax. Record parse failures instead of silently falling back to unreliable regex-only conclusions.

Extract:

- Imports, dynamic imports, workers, service workers, and WebAssembly loaders
- Route definitions, API bases, WebSocket and SSE endpoints
- REST paths, GraphQL operations, RPC methods, and parameter names
- Feature flags, environment labels, tenant identifiers, and internal hostnames
- Framework and library fingerprints with evidence locations
- Client-side authorization and role checks

### 3. Map browser-controlled sources

Track values from:

- URL, query, fragment, path, referrer, and window name
- postMessage, BroadcastChannel, MessageChannel, and storage events
- cookies, localStorage, sessionStorage, IndexedDB, and Cache API
- DOM text, form values, file metadata, clipboard, drag and drop
- WebSocket, SSE, fetch, GraphQL, and extension messages

### 4. Map security-sensitive sinks

Record the sink, surrounding encoding, guard, and reachable source:

- HTML and script construction
- URL navigation, redirects, iframe sources, and window opening
- dynamic code, template execution, and WebAssembly compilation
- postMessage targets and message dispatch
- storage of tokens or private records
- service-worker cache and routing decisions
- client-side GraphQL or REST mutations
- unsafe object merges and prototype-sensitive keys

A source and sink in the same file is not a vulnerability. Require a reachable dataflow or a minimal runtime discriminator.

### 5. Analyze postMessage as a protocol

For each listener, record:

- Expected origin and source window
- Message schema and type discriminator
- Authentication or nonce binding
- Privileged action or data returned
- Reply target origin
- Nested iframe and popup assumptions

Propose a proof only with an owned sender origin and controlled data.

### 6. Review secrets without spreading them

Classify candidates as public identifier, test value, expired token, high-entropy unknown, or likely credential. Store a hash and redacted prefix, not the complete value. Validate only through a non-destructive metadata endpoint when scope explicitly permits it.

### 7. Connect client evidence to captured traffic

Join operations by method, normalized path, parameter names, GraphQL operation name, and content hash. Flag:

- code paths not observed in traffic
- observed endpoints missing from current bundles
- privileged mutations guarded only in the client
- alternate API versions or hosts
- inconsistent object, tenant, or role parameters

### 8. Produce falsifiable leads

```yaml
id: js-lead-001
source: file-or-url
location: line-or-symbol
entry: attacker-controlled source
transforms: []
sink: security-sensitive operation
guard: observed validation or authorization
reachability: proven | probable | unknown
hypothesis: one claim
runtime_discriminator: one controlled test
negative_control: safe comparison
stop_condition: explicit boundary
confidence: 0.0-1.0
```

## Framework pivots

- Next.js: build manifests, route chunks, server actions, RSC boundaries, image loaders, middleware assumptions
- React: dangerous HTML, URL sinks, hydration data, client-only role gates
- Angular: sanitizer bypass APIs, template compilation, trust wrappers
- Vue and Nuxt: raw HTML directives, hydration state, server routes, plugin injection
- Webpack and Vite: chunk maps, environment substitution, source-map exposure, module federation
- GraphQL clients: persisted-query hashes, hidden mutations, cache identity, optimistic updates

## Completion gate

Finish when all files are hashed and classified, parse failures are explicit, endpoints and operations are deduplicated, each high-risk sink has a reachability decision, secret candidates are redacted, and every lead has a controlled discriminator and negative control.