js-analyzer

This skill is not credential-harvesting malware, but it is a high-risk offensive security skill. Its capabilities are aligned with its stated pentesting purpose, yet that purpose itself gives an AI agent powerful exploit and scanning workflows, broad shell execution, and exposure to untrusted external content.

The provided fragment is clearly recon/automation tooling that downloads a target’s JavaScript assets, searches for embedded secrets using explicit credential-pattern regexes, extracts API path hints, and probes for exposed source maps. It does not show overt malware capabilities like persistence or network exfiltration within the snippet, but it is operationally dangerous and would be high risk if integrated into an automated dependency/build pipeline because it is designed to discover sensitive information and expand attack surface. No package/library supply-chain behavior is shown in the fragment itself.