Jss

JS 侦察流水线编排（自带工具链 + Yakit/浏览器 MCP + 开源 HaESkill 联动）：按输入类型自适应——URL 走 katana 主动爬取（硬限速防风控）+ waymore 被动存档（目标站 0 请求），Yakit 有抓包流量则导入登录态 JS 与 API 端点，小程序反编译目录/本地 dist 直接分析（无爬取路径，analyze 即全流程）。双提取引擎（jsluice AST + 正则）+ hae 规则增强产出 ai_brief.md，AI 再做语义分析与优先级排序。任何环节阻塞自动跳过并汇总告知。仅用于授权渗透测试/SRC。触发词：分析js、js分析、js侦察、js信息收集、JS审计、js审计、前端信息收集、前端安全分析、提取接口、接口提取、端点提取、API提取、敏感信息提取、密钥提取、小程序分析、分析小程序、小程序逆向、反编译js分析、sourcemap、源码还原、HAR分析、抓包分析、Yakit流量分析、SRC信息收集、HaESkill、hae、jss。

10 starsAI, LLMs & Agents

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add ZeroTu1/jss-skill --skill jss

Manual install

git clone --depth 1 https://github.com/ZeroTu1/jss-skill.git /tmp/jss-skill
mkdir -p ~/.claude/skills
cp -r /tmp/jss-skill/. ~/.claude/skills/jss

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# jss 编排手册（AI 按此执行）

工具做广度（爬、收、批量提取），AI 做深度（读 ai_brief.md 做语义分析、排优先级、回源核实）。只用于已授权目标。

**本 skill 自带全部工具**（bin/jsluice.exe、bin/katana.exe、waymore-8.9/），拿到任何机器解压即用，无需另装 Go/katana。唯一外部依赖：Python ≥3.8 + 四个 pip 包（见 requirements.txt）。结果默认落在**会话目录** `work\<目标名>\`（AI 可直接看到已有产物，避免重复爬取；可用 JSS_WORK 环境变量重定位），AI 第一入口是 `report\ai_brief.md`。

## Step 0 查已有产物（避免重复爬取）

**在 Step 1 之前，AI 必须先检查会话目录下 `work/<目标名>/` 是否存在且已有 `report/ai_brief.md`：**

- **已有完整报告** → 跳过 Step 2~4，直接走 Step 5（analyze 取最近一次结果）→ Step 6（AI 语义分析）。用户追加新信息（如新 Yakit 流量）时，ingest 会合并到已有目录，然后 re-run analyze。
- **只有部分数据**（如只有 `js/` 但无 `flows_endpoints.txt`）→ 增量补充（如查 Yakit 流量）→ 再 analyze。
- **无目录** → 走完整流程。

## Step 1 判定输入类型，选路径（全场景覆盖）

| 用户给的输入 | 执行路径 |
|---|---|
| URL / 域名 | Step 2（Yakit 流量）→ Step 3（collect）→ Step 4（passive）→ Step 5（analyze） |
| 本地目录（小程序反编译、dist、下载的 JS） | **只走 Step 5**：`python jss.py analyze <目录1> <目录2>`，不发任何网络请求。反编译小程序会被自动识别（app-service.js/app.json 特征 + appid 提取），简报概览标记场景 |
| HAR 文件 | `python jss.py har <file.har>` → Step 5 |
| Yakit/浏览器 MCP 流量 JSON | `python jss.py ingest <flows.json> --name <目标名>` → Step 5 |
| "分析上次/某个目标的结果" | `python jss.py list` 确认 → Step 5（analyze 默认取最近一次） |
| 只要敏感信息扫描、不要端点/收集 | **别用本 skill**，直接加载 hae skill（开源 HaESkill：https://github.com/overspace-labs/HaESkill，见下方联动章节） |

## Step 2 Yakit 登录态流量（AI 自动执行：Yakit MCP 在线即查，不依赖用户显式要求）

**行为规则：** 只要当前会话有 Yakit MCP 工具可用（无论用户是否提及），AI 在 Step 1 判定输入类型后，必须自动执行本步骤。Yakit MCP 不存在则记录"无 Yakit MCP"跳过。这是 AI 的自主行为，不是等待用户指令。

Read the full skill on GitHub

Details

Skill name: jss
Repository: ZeroTu1/jss-skill
Repo updated: 31 August 2026

FAQ

What does the Jss skill do?

How do I install the Jss skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add ZeroTu1/jss-skill --skill jss. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Jss popular?

It lives in ZeroTu1/jss-skill, which has 10 GitHub stars and 0 forks.

Related skills

Loop Engineering

sxivansx/loop-engineering

Use when the user wants to "set up a loop", build a self-running or run-until-done agent, automate a recurring engineering task (triage, keep-CI-green, dependency bumps, backlog burndown), or stop hand-prompting an agent turn by turn. Sets up an autonomous engineering loop in the current project. It discovers work, runs a maker agent and a separate checker agent, records state on disk, and re-triggers until a verifiable stop condition is met.

AI, LLMs & Agents

Genpark Ambient Vision Anchor Skill

Alpha-Park/genpark-ambient-vision-anchor-skill

GenPark AI Agent Skill - Multimodal ambient visual anchoring connecting physical device perception (smart glasses, camera feeds) with GenPark digital agent services.

AI, LLMs & Agents

Prometheus

Samuele95/prometheus

Build-time meta-prompting framework that designs, audits, and refactors prompts for tool-calling LLM agents. Use whenever the user wants to write, design, build, improve, refactor, or audit any prompt — a system prompt, agentic-loop seed brief, one-shot task, workflow chain, sub-agent or tool description, system persona, LLM-as-judge or grader rubric, or multi-agent team. Trigger on requests like "write a prompt for X", "I need a system prompt", "design a grader", "build an agent", "set up a Claude Code prompt", "fix/improve/refactor my prompt", or when the user invokes /prometheus — and even

AI, LLMs & Agents

Build Managed Agents

YijiaDuan/build-managed-agents

教 Claude Code / OpenClaw 等 coding agent 使用 Anthropic Claude Managed Agents（云端托管代理服务）API —— create/run/audit 全流程。当用户（或上游 coding agent）需要创建托管 agent、跑 session、流式处理事件、审计用量或调用 /v1/agents、/v1/environments、/v1/sessions 等 API 时使用。触发词：managed agents、托管代理、build a managed agent、agent_toolset_20260401、client.beta.agents、client.beta.sessions。

AI, LLMs & Agents

RAG Eval Workflow

w93139/rag-eval-workflow

Build and compare reproducible evaluations for RAG, knowledge-base, vector-search, chunking, embedding, indexing, and retrieval-backed data projects. Use for golden datasets, regression checks, and failure diagnosis, especially for scripts or jubensha corpora; do not activate for ordinary coding or generation-only prompt tests without retrieval.

AI, LLMs & Agents

Bakeoff

CoriChui/bakeoff

Turn one decision into a judged tournament of solutions, then pick the best. Given a problem, design choice, or a suggestion you want cross-verified, it generates diverse candidate solutions, auto-derives the evaluation dimensions for THAT problem (so you don't have to know what to score on), judges every candidate with independent scorers, and returns the winner plus a ranked top-N shortlist with a score matrix and rationale. It auto-infers the request shape — idea · improvement · comparison · proposal ("what if we do X") · problem-solving · scoping — from your bare prompt, with no flags. Rea

AI, LLMs & Agents

Browse the most popular Claude skills, all ai, llms & agents skills, or write your own with the skills generator.