Guide · Agent skill
How to use the JavaScript Malware Deobfuscator agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This is an agent skill that guides an AI agent through reverse-engineering obfuscated JavaScript found in phishing pages, web skimmers and dropper scripts. It is aimed at security analysts, incident responders and malware researchers who need a repeatable first pass at decoding suspicious scripts. After this guide you will know how to install the skill, how to phrase a request that triggers it, and what safety precautions to take before running anything.
JavaScript Malware Deobfuscatormukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it. The folder contains SKILL.md, scripts/agent.py and references/api-reference.md.
- 2Place the folder. Move the unzipped folder into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Prepare an isolated VM. Set up an analysis environment with no access to production systems or sensitive data before you handle any sample.
- 4Install the Python dependency. Install the jsbeautifier Python library and make sure Node.js 18+ is available.
- 5Ask for the analysis. Describe the task in plain language, such as deobfuscating a phishing page or a Magecart skimmer, and provide the HTML file.
- 6Review the decoded output. Check the decoded scripts and the logged eval contents, and verify important strings in CyberChef if needed.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions and optional scripts that an AI agent can load when a task matches its description. This skill, deobfuscating-javascript-malware, is designed for investigating malicious JavaScript. It tells the agent to extract script tags from HTML, beautify the code, identify encoding tricks such as hex, base64 and fromCharCode, decode string layers, and work through eval chains to expose the original malicious behavior.
The skill includes a bundled Python helper, scripts/agent.py, which performs beautifying and pattern-based decoding of these encodings.
- Extracts JavaScript from HTML files into separate script files
- Beautifies minified or obfuscated code
- Identifies common obfuscation techniques such as hex escapes, unicode escapes, base64, fromCharCode, array lookups, eval chains and anti-analysis traps
- Decodes string layers and unwraps eval chains in a controlled way
Install the skill from the ZIP download
Download the ZIP for this skill from this page and unzip it. To make it available for your personal use across projects, place the unzipped folder in ~/.claude/skills/. To make it available only inside one project, place it in that project's .claude/skills/ folder.
If you use the Claude apps instead, you can upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Check the requirements before you start
The skill expects a few tools on the machine doing the analysis. The required items are Python 3.8+ with the jsbeautifier library and Node.js 18+ for controlled JavaScript execution. Optional tools include Chrome DevTools or an isolated browser for dynamic analysis, and CyberChef, de4js or JStillery for manual or automated deobfuscation.
The skill recommends an isolated analysis VM. It runs scripts and does not use the network, according to its listing.
- Required: Python 3.8+, jsbeautifier Python library, Node.js 18+
- Optional: Chrome DevTools or an isolated browser, CyberChef, de4js, JStillery
- Recommended: an isolated analysis VM with no access to production systems or sensitive data
pip install jsbeautifierTrigger the skill with natural requests
You do not need to type the skill name. Describe the task in plain language that matches the skill's purpose. The skill's description names three situations: investigating a phishing page's obfuscated JavaScript, analyzing a Magecart-style web skimmer, and deobfuscating a JavaScript dropper that fetches second-stage malware.
Give the agent the file and say what you want. Mentioning the situation helps the agent match the skill.
- "Deobfuscate the JavaScript in this phishing page and tell me what it does."
- "Analyze this suspected Magecart skimmer injected into our checkout page."
- "This dropper script fetches a second-stage payload. Help me unwrap the eval chain."
- "Extract the scripts from this HTML email attachment and decode the strings."
Work through a typical analysis
The skill follows a workflow. First it extracts scripts from the HTML without running them. It then beautifies the code and categorizes the obfuscation methods. Next it neutralizes anti-analysis traps such as debugger loops and DevTools checks, decodes string layers progressively, and finally resolves eval chains using a sandboxed context that logs the code instead of executing it.
The skill's example extraction step saves each script as script_0.js, script_1.js and so on, and writes the beautified version to a separate file. Expect to repeat decoding passes, since many samples nest several layers.
- Extract scripts from the HTML file without executing them
- Beautify the extracted code
- Identify obfuscation techniques
- Remove anti-analysis protections
- Decode string layers
- Resolve eval chains safely
npx js-beautify script_0.js -o script_0_pretty.jsSafety rules to follow
Malicious JavaScript can compromise the machine that runs it or leak data. The skill assumes you work in an isolated VM with no access to production systems or sensitive data. Do not run samples on your normal workstation. The skill's eval-chain example intercepts eval and document.write rather than executing the payload, and you should keep it that way.
The skill is not meant for simply minified production code. For that, a standard beautifier is enough.
- Use an isolated analysis VM
- Do not give the agent access to production systems or credentials
- Keep the sandbox that returns code instead of executing it
- Use a standard beautifier for ordinary minified JavaScript
Tips for better results
Give the agent the full HTML file rather than a fragment, because the extraction step depends on script tags. If the first decoding pass leaves base64 or eval calls behind, ask the agent to continue with another pass rather than starting over.
Use CyberChef to verify individual decoded strings when the automated output is unclear.
- Provide complete HTML files so script tags can be extracted
- Ask for repeated decoding passes on nested layers
- Cross-check tricky strings in CyberChef, de4js or JStillery
What people use it for
- Triage a suspicious phishing page or HTML email attachment to see whether it harvests credentials or redirects victims.
- Investigate a Magecart-style skimmer injected into an e-commerce checkout page.
- Unwrap a JavaScript dropper to find the URL of the second-stage malware it fetches.
- Produce a readable, beautified copy of an obfuscated script for a written incident report.
Frequently asked questions
Is the JavaScript Malware Deobfuscator skill free to use?
The skill is published under the Apache-2.0 licence, as stated on this page. Check the licence file in the downloaded folder for the full terms.
What do I need installed to use this skill?
You need Python 3.8+ with the jsbeautifier library and Node.js 18+. Chrome DevTools, CyberChef, de4js or JStillery are optional, and an isolated analysis VM is recommended.
Where do I put the skill folder?
Place it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Does this skill run code or use the internet?
The skill runs scripts and does not use the network, according to its listing. Its workflow still expects you to handle samples inside an isolated VM.
Can I use this for normal minified JavaScript?
No. The skill itself says a standard beautifier is enough for minified production code. It is meant for obfuscated malicious scripts.
How does this compare with CyberChef or de4js?
CyberChef, de4js and JStillery are standalone tools you operate manually or semi-automatically. This skill has an agent work through the steps, using a Python helper for beautifying and pattern-based decoding, and it can use those tools to cross-check results.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security analyst, incident responder or malware researcher who needs a repeatable first pass at decoding obfuscated JavaScript from phishing pages, skimmers or droppers, and you can work inside an isolated VM. Pick something else if you only need to format ordinary minified code or clean up general JavaScript, since a standard beautifier is simpler.
Download the skill