jsr-reverse
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [SAFE]: The skill provides an engineering framework for legal and technical analysis of JavaScript code. It defines clear boundaries and artifacts for documentation.
- [DYNAMIC_EXECUTION]: The skill facilitates the analysis and local execution of JavaScript code for reverse engineering purposes. This involves handling obfuscated logic (JSVMP), workers, and WASM. This behavior is the primary intended function of the skill and is documented as part of the 'runtime' and 'recover' stages.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data such as website source code and network traffic. 1. Ingestion points: The skill ingests target page URLs, headers, and JS code during the intake and locate stages. 2. Boundary markers: The framework uses structured artifact files like 'reverse-records/请求链路.md' to delimit findings. 3. Capability inventory: The skill utilizes runtime environments (e.g., JSDOM) to execute and test analyzed code. 4. Sanitization: The workflow spine mandates manual validation and evidence-backed recording to mitigate injection risks.
- [OBFUSCATION]: Several reference files contain text artifacts appearing as Mojibake (e.g., in 'references/wasm-worker-webpack.md'). These appear to be unintentional encoding errors related to Chinese-language technical content rather than intentional malicious obfuscation. No hidden URLs or executable commands were detected within these segments.
Audit Metadata