Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/OpenAisec/Miko --skill pentest-jsThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
渗透测试实战技能 v1.2.0。覆盖信息收集、漏洞发现 (3梯队9+3+6类)、漏洞利用、后渗透、免杀全流程。 当用户给出具体目标 (IP/域名/URL) 且意图是攻击/利用/拿权限时触发。 不触发: 概念讨论、蓝队防御、代码审计、CVE文档查询。
所有联网操作必须通过此 skill 处理，包括：搜索、网页抓取、登录后操作、网络交互等。 触发场景：用户要求搜索信息、查看网页内容、访问需要登录的网站、操作网页界面、抓取社交媒体内容（小红书、微博、推特等）、读取动态渲染页面、以及任何需要真实浏览器环境的网络任务。
Direct browser control via CDP for web interaction: automation, scraping, testing, screenshots, and site/app work.
Based on SOC occupation classification
Showing SKILL.md
| category | web |
| name | pentest-js |
| description | JS信息收集入口 - 提取硬编码凭据、API路径、路由、认证逻辑、运行时存储；检测到框架特征时触发对应子技能 |
| when_to_use | 指纹识别完成后，对目标JS深度分析 |
所有 JS 内容获取必须优先使用 Playwright MCP，禁止直接用 curl 读取JS：
playwright_navigate → playwright_get → playwright_console_logs → playwright_evaluate
curl 仅限 Playwright 不可用时降级。
所有输出写入 tmp/<时间戳>/raw/，项目根目录禁止存放。
playwright_get_visible_html 提取 <script src="...">playwright_evaluate 监听 performance.getEntriesByType('resource') 获取动态加载JS优先级：P0（ipconfig/config/api/setting/routes/permission.js）→ P1（app/chunk-vendors/chunk-*.js）→ P2（第三方SDK/.map）
搜索关键词覆盖 6 类：认证凭据(apiKey/appSecret/token/password/Basic auth)、云服务Key(AWS/阿里云/腾讯云)、数据库连接串、加密密钥(AES/RSA/HMAC)、注释、内网地址。
发现凭据后记录：类型 | 文件 | 值（脱敏前5+后3）| 风险等级。
baseUrl/axios.create/fetch( 等提取createRouter/VueRouter/createBrowserRouter/<Route path=playwright_evaluate → $router?.getRoutes() 或 $router?.options?.routessign/signature/hmac → 提取字段拼接顺序和secret来源refreshToken/refreshdev/staging/production → 各环境baseURL → 生产JS残留的测试地址debug/VConsole/erudaindexedDB.databases()$.ajaxSetup中的baseURL/headers/CSRF Token发现即测，不等到最后。
| 检测特征 | 触发 |
|---|---|
JS末尾含 sourceMappingURL | sourcemap.md |
webpackJsonp 或 chunk hash命名 | webpack.md |
__vue__/__vue_app__/createRouter | vue.md |
__NEXT_DATA__/React.createElement/jsx( | react.md |
navigator.serviceWorker | service-worker.md |
new WebSocket(/io(/SignalR | websocket.md |
ApolloClient/Relay/urql/`gql`` | graphql-client.md |
js_files.txt / hardcoded_creds.txt / apis_from_js.txt / routes.txt / internal_ips.txt / auth_logic.txt / runtime_storage.txt / 各子技能目录