Bundle and Source Map Recovery
Lets an agent trace built JavaScript bundles, source maps and chunk loaders to explain frontend runtime behavior in CTF sandboxes.
- Repository
- zhaoxuya520/reverse-skill
- Stars
- 43,969
- Licence
- MIT
- Files
- 3 files
What it does
This skill teaches an AI agent a focused method for analysing the compiled JavaScript a web app serves to browsers, such as bundles, build manifests, chunk maps and source maps. Once installed, the agent follows a set order: it maps the served files, reconstructs how code is loaded at runtime, and reduces the findings to one minimal path from asset to behaviour. It is written as a downstream step for a capability-focused CTF sandbox workflow and expects a parent skill (ctf-sandbox-orchestrator) to have set the sandbox assumptions first. It also asks the agent to reply in Simplified Chinese unless English is requested.
Great for
- Security students working through capture-the-flag (CTF) style frontend challenges in an authorised sandbox
- Researchers who want a structured checklist for reading built frontend artifacts
- Developers debugging how a lazy-loaded bundle or chunk is served versus what the repository source says
Skip it if
- Analysing production websites or systems you do not own or have no written permission to test, since the skill is designed for sandboxed competition use and that restriction is the user's responsibility
- Simple source-code reading or debugging of your own project, where the normal repository source is enough and this method adds little
- Server-side rendering or template enforcement problems, which the SKILL.md itself says should be handed to a different skill
Try asking
- “Map the served artifacts for this sandbox app: entry HTML, build manifest, chunk map and source map URLs.”
- “Trace how the bootstrap bundle loads the chunk that contains the admin route, and list the endpoint strings it calls.”
- “Compare the served bundle with the repository source and tell me where they diverge.”
- “Summarise the smallest asset-to-runtime sequence that explains the hidden panel's behaviour.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the MIT licence and an attribution note.
competition-bundle-sourcemap-recovery.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip competition-bundle-sourcemap-recovery.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip competition-bundle-sourcemap-recovery.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only use it inside an authorised sandbox or competition environment, and state that scope in your request.
- Provide the artifacts you already have (bundle files, source maps) rather than asking the agent to fetch them, since the skill itself does not describe any fetching.
- Expect Simplified Chinese replies by default; ask for English explicitly if you need it.
What's inside
- agents/openai.yaml
- references/bundle-sourcemap-recovery.md
- SKILL.md
Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.