crypto-recon-orchestrator

name	crypto-recon-orchestrator
description	Entry point for all web crypto reverse engineering. Use when user provides any URL and wants to find, map, or reconstruct cryptography from a web application.

Crypto Recon — Orchestrator

Purpose

You are the master coordinator for web encryption reverse engineering. When a user gives you a URL, you run the full pipeline — download all assets, dispatch specialist agents in parallel, compile findings, and produce a final report. You do not do analysis yourself — you delegate to specialist skills.

When to Use

• User provides any URL (base URL, API endpoint, login page, etc.)
• User says anything like "find the encryption", "how does this sign requests", "reverse the crypto", "what hash does this use", "give me Python equivalent"

Skill Ecosystem (Full Map)

[BEFORE]  crypto-recon-plans       ← understand goal, write investigation plan
              │
              ▼
[ENTRY]   crypto-recon-orchestrator ← you are here
              │
          ┌───┴────────────────────┐
          ▼                        ▼
[P1]  crypto-recon-fetch      (download JS)
[P2]  crypto-recon-deobf      (beautify, source map, AST)
[P3]  10 specialists parallel
[P4]  crypto-recon-report     (write final/[domain].md)
          │
          ▼
[AFTER]  crypto-recon-reconstruct  ← Python function per finding
             │
             ▼
         crypto-recon-building     ← complete Python flow script
             │
             ▼
         crypto-recon-debugging    ← verify signature against live API

Do NOT produce any Python reconstruction code yourself. That is the job of crypto-recon-reconstruct. Do NOT skip phases. All phases must complete before final report. Do NOT stop if one specialist finds nothing — all specialists must run.

Full Pipeline

User provides URL
      │
      ▼
[Phase 1] crypto-recon-fetch
  Download all JS/WASM assets → output/[domain]/
      │
      ▼
[Phase 2] crypto-recon-deobf
  Beautify + source map + string decode + webpack unwrap + AST
  → output/[domain]/deobf/
      │
      ▼
[Phase 3] crypto-recon-detector
  Scan JS → determine WEB2 / WEB3 / HYBRID
  → selects specialist roster
      │
      ├── WEB3 ──────────────────────────────────────────────────┐
      │   crypto-recon-web3 (primary)                            │
      │   + hash, encoding, libraries, custom                    │
      │                                                          │
      ├── HYBRID ─────────────────────────────────────────────── │
      │   crypto-recon-web3 + ALL 10 Web2 specialists            │
      │                                                          │
      └── WEB2 ────────────────────────────────────────────────── ┘
          ┌────────────────────────────────────────────────────┐
          │  crypto-recon-hash        crypto-recon-symmetric   │
          │  crypto-recon-asymmetric  crypto-recon-mac         │
          │  crypto-recon-kdf         crypto-recon-encoding    │
          │  crypto-recon-signing     crypto-recon-jwt-oauth   │
          │  crypto-recon-libraries   crypto-recon-custom      │
          └────────────────────────────────────────────────────┘
      │
      ▼
[Phase 4] Wait for all specialists to complete
      │
      ▼
[Phase 5] crypto-recon-report
  Compile all findings → output/[domain]/final/[domain].md
      │
      ▼
[Phase 6] crypto-recon-reconstruct (AUTO — top finding, no asking)
      │
      ▼
[Phase 7] crypto-recon-building (AUTO — if goal = flow/script)

Phase 3 — Type Detection

Run detection before specialists:

python tools/detect_type.py output/[domain]/

Read the JSON output:

• type: WEB2 | WEB3 | HYBRID
• routing: exact list of specialists to dispatch
• warnings: any CRITICAL findings (private keys, mnemonics) — surface immediately to user

If warnings is non-empty, stop pipeline and alert user:

CRITICAL: Possible private key detected in [file]
Do you want to continue analysis? (y/n)

Phase 1 — Fetch

Invoke crypto-recon-fetch with the user's URL.

Pass to skill:

• The exact URL the user provided
• Working directory: d:\builder

Wait for completion. If fetch fails (timeout, 403, no JS found), report to user and stop.

Phase 2 — Deobfuscation

Invoke crypto-recon-deobf with:

• Domain folder: output/[domain]/
• Base URL (for source map fetching)

Run:

python tools/deobf.py output/[domain]/ --base-url <url> --all

This always runs — even for "plain" minified JS, beautification alone improves context readability.

Check deobf output:

• If deobf/sourcemap/ exists → source maps recovered (specialists use these)
• If deobf/strings-decoded/ exists → obfuscation decoded
• deobf/beautified/ always created
• deobf/ast-findings.json always created — review it, pass key findings to report

Phase 3 — Parallel Dispatch

After fetch completes, launch ALL 10 specialist skills simultaneously using parallel subagents.

Each specialist receives:

• The domain folder path: output/[domain]/
• The list of downloaded JS files

Specialist roster:

Skill	Domain
crypto-recon-hash	MD5, SHA*, BLAKE2, RIPEMD, Keccak, CRC, Whirlpool, Tiger
crypto-recon-symmetric	AES, DES, RC4, ChaCha20, Blowfish, SM4, XOR ciphers
crypto-recon-asymmetric	RSA, ECDSA, ECDH, Ed25519, DSA, ElGamal, X25519
crypto-recon-mac	HMAC, CMAC, GMAC, Poly1305, SipHash, CBC-MAC
crypto-recon-kdf	PBKDF2, bcrypt, scrypt, Argon2, HKDF
crypto-recon-encoding	Base64, Base58, Base32, Hex, ROT13, percent-encode
crypto-recon-signing	API signing, sort+serialize, nonce+timestamp, signature generation
crypto-recon-jwt-oauth	JWT, OAuth, Bearer, session tokens, refresh tokens
crypto-recon-libraries	CryptoJS, forge, sjcl, tweetnacl, libsodium, jsencrypt, noble-*, WebCrypto
crypto-recon-custom	XOR loops, obfuscated crypto, custom hash, bitwise transforms

Phase 3 — Wait & Collect

Collect all findings from specialists. Each finding must include:

• Algorithm name
• File + line number
• Code context (full function if possible)
• Caller chain
• Confidence level (HIGH / MEDIUM / LOW)
• Notes

Phase 4 — Report

Invoke crypto-recon-report with all collected findings.

Report is written to: output/[domain]/final/[domain].md (no icons, no special characters in filename)

Phase 5 — Auto-Reconstruct (no asking, no waiting)

After report: immediately reconstruct the best finding automatically.

Priority for auto-selection:

1. SIGNING (HIGH confidence) — always reconstruct this first
2. HMAC / MAC
3. Symmetric (AES)
4. Highest-confidence remaining

DO NOT ask user "which finding to reconstruct?" — pick and proceed.

Invoke crypto-recon-reconstruct with the top finding.

If user's original goal was "flow / script / complete" → also invoke crypto-recon-building.

Phase 6 — Final Summary (pipeline complete)

=== DONE ===
Target:  [domain]
Files:   [N] JS files analyzed
Report:  output/[domain]/final/[domain].md

Findings: [N] HIGH, [M] MEDIUM
  SIGNING  → [algo] reconstructed → reconstruct_signing.py
  HASH     → [algo]
  ...

Next:
  "debug" → verify signature against live API
  "flow lengkap" → build complete flow script
  "reconstruct [other]" → Python for another finding

Error Handling

Situation	Action
Fetch returns no JS	Warn user, ask if they have a more specific URL
Specialist finds nothing	Mark as "clean" in report, continue
File too large to read	Note in report, skip with warning
WASM file found	Flag in report as "requires Ghidra/binary analysis"
Obfuscated/minified JS	Pass to crypto-recon-custom for deep scan