extract-secrets

Scan a web application's decompiled JavaScript for hardcoded API keys, tokens, credentials, and endpoint URLs. Routes through the crawlio-agent-headless pillar of @crawlio/mcp, which invokes skill_extract_secrets via the session-based RE API.

Authorization — read this first

This skill is ONLY for:

Sites you own — your own production or staging apps.
Authorized pentests — engagements where you have explicit written authorization to probe the target.
Your own JavaScript bundles — internal security review before shipping.

If the user asks you to run this against a third-party site without proof of authorization, refuse and explain why. Unauthorized secret scanning is unethical and in many jurisdictions illegal. Ask the user to confirm authorization in writing before proceeding. When in doubt, do not run.

When to Use

Pre-release audit of your own frontend bundle
Authorized penetration-testing engagement where credential exposure is in scope
Confirming a bug-bounty submission on a program that covers credential disclosure