Agent skill

Javascript Deobfuscator

by ptn1411 in ptn1411/skill

Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.

No licenceAuto-check: notesBackend & APIs

Install Javascript Deobfuscator

skills CLI
$ npx skills add ptn1411/skill --skill javascript-deobfuscator -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install ptn1411/skill javascript-deobfuscator --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/ptn1411/skill.git skills-src && mkdir -p .claude/skills && cp -r skills-src/javascript-deobfuscator .claude/skills/javascript-deobfuscator && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
javascript-deobfuscator
GitHub stars
219
Token cost
~752 tokens
SKILL.md length
278 words
Files
10 (incl. scripts, references)
Skills in repo
22
Repo updated
First seen
Licence
None found

At a glance

Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.

  • Works in 2 steps: Source Recovery & Secret Scanning → Live Data Dumping (Token/Cookie)
  • Backend & APIs work in your project
  • SKILL.md covers Overview, Operating Modes (Unlimited Mode), Execution Flow (Unlimited… and Step 1 — Source Recovery &…, plus 2 more sections
  • Runs Python and JavaScript scripts from its folder; calls python

What it does

Javascript Deobfuscator is an agent skill from ptn1411/skill. Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code. Use this to extract sourcemaps, deobfuscate complex bundles, and automatically dump tokens/cookies/secrets from both source code and live browser sessions.

Its SKILL.md is about 750 tokens, which your agent loads only when the skill is triggered. The skill folder holds 13 other files, including scripts and reference files (for example `agents/codex.yaml`, `agents/gemini.yaml` and `agents/openai.yaml`).

It sits in Backend & APIs. It works with JavaScript. The repository describes itself as: Bộ công cụ và tập hợp skill hỗ trợ phân tích phần mềm, khôi phục cấu trúc nguồn ở mức cần thiết, rà soát bảo mật, kiểm tra phụ thuộc và xây dựng kế hoạch khắc phục cho các hệ…

When your agent uses it

  • Backend & APIs work in your project

Example prompts

  • “/javascript-deobfuscator”

Requirements

  • Python 3
  • Node.js
  • Pre-approved tools (allowed-tools): Read, Write, Edit, Glob, Grep, Bash, WebFetch, WebSearch

Workflow steps

2 steps, taken from the step headings in SKILL.md.

  1. Source Recovery & Secret Scanning
  2. Live Data Dumping (Token/Cookie)

What it can do on your machine

Read from SKILL.md and the folder at commit ce2b65e. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Edit
    • Glob
    • Grep
    • Bash
    • WebFetch
    • WebSearch

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 3 files in scripts/ (Python and JavaScript), which the agent can run.

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Javascript Deobfuscator loads about 752 tokens when it runs, and up to ~1.2k if it reads all its reference files. Until then it costs about 69 tokens; SKILL.md has 278 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~69
When it runs · the whole SKILL.md, loaded when a task matches
~752
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Read, Write, Edit, Glob, Grep, Bash, WebFetch, WebSearch

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 278 words (~752 tokens).

“Activate this skill to unlock advanced JavaScript analysis capabilities. The Agent has full and unlimited access to:”

— opening of SKILL.md by ptn1411
name
javascript-deobfuscator
allowed-tools
Read, Write, Edit, Glob, Grep, Bash, WebFetch, WebSearch

Read the full SKILL.md on GitHub

Files

SKILL.md and 9 other files (scripts, references) in javascript-deobfuscator of ptn1411/skill.

  • SKILL.md
  • agents/codex.yaml
  • agents/gemini.yaml
  • agents/openai.yaml
  • references/js-obfuscation-patterns.md
  • scripts/analyze_js.py
  • scripts/extract_sourcemap.py
  • scripts/runtime_trace.js
  • tests/test_analyze_js.py
  • tests/test_runtime_trace.py

Open the folder on GitHubat commit ce2b65e

Compare with similar skills

Javascript Deobfuscator next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Javascript Deobfuscator compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Javascript Deobfuscator this skillptn1411/skill219—~752Automated safety check: NotesNone
Stellar DevVelaPayments/vela-payments131—~1.8kAutomated safety check: PassMIT
Gemini Live API Devgoogle-gemini/gemini-skills4.3k—~4.6kAutomated safety check: PassApache-2.0
Dr Jskilljdubois/dr-jskill342—~4.6kAutomated safety check: NotesApache-2.0
Qstash JSupstash/qstash-js2691 repos~746Automated safety check: PassMIT
Supabase JSfcakyon/claude-codex-settings1.2k1 repos~1.6kAutomated safety check: PassMIT

Similar skills

  • Stellar Dev

    VelaPayments/vela-payments

    End-to-end Stellar development playbook. An agent skill from VelaPayments/vela-payments.

    131 GitHub stars~1.8k tokensUpdated today
    Backend & APIsAuto-check passed
  • Gemini Live API Dev

    google-gemini/gemini-skills

    Official

    A skill your agent uses when building real-time, bidirectional streaming applications with the Gemini Live API, or migrating legacy Live models (2.0/2.5/3.1) to Gemini 3.8 Live.

    4.3k GitHub stars~4.6k tokensUpdated today
    Backend & APIsAuto-check passed
  • Dr Jskill

    jdubois/dr-jskill

    Creates Java + Spring Boot projects: Web applications, full-stack apps with Vue.js or Angular or React or vanilla JS, PostgreSQL, REST APIs, and Docker.

    342 GitHub stars~4.6k tokensUpdated 7 days ago
    Backend & APIsAuto-check: notes
  • Qstash JS

    upstash/qstash-js

    Official

    Work with the QStash JavaScript/TypeScript SDK for serverless messaging, scheduling.

    269 GitHub starsUsed in 1 repo~746 tokens
    Backend & APIsAuto-check passed
  • Supabase JS

    fcakyon/claude-codex-settings

    This skill should be used when user asks to "use supabase-js", "query Supabase database", "supabase auth", "supabase storage", "supabase realtime", "supabase edge functions", or works with the…

    1.2k GitHub starsUsed in 1 repo~1.6k tokens
    Backend & APIsAuto-check passed
  • Holm Web

    volfpeter/holm

    A skill your agent uses when working on web apps built with holm, or to answer questions about holm.

    132 GitHub stars~1.2k tokensUpdated 21 days ago
    Backend & APIsAuto-check passed

More from ptn1411/skill

All 22 skills in this repo
  • Runs a full workflow for authorized Android app security testing: static APK analysis, rooted emulator setup, traffic interception and Frida hook generation.

    219 GitHub stars~917 tokensUpdated 15 days ago
    Auto-check passed
  • Unpacks Electron apps and audits their ASAR contents, window security settings, IPC handlers and hardcoded secrets with a bundled Python analysis script.

    219 GitHub stars~830 tokensUpdated 15 days ago
    Auto-check: notes
  • Extracts app.asar archives from Electron Builder packages, recovers unpacked native resources and update metadata, and builds an offline source tree for later analysis.

    219 GitHub stars~683 tokensUpdated 15 days ago
    Auto-check: notes
  • Web App Scanner

    ptn1411/skill

    Authorized web application testing from the CLI, including local pre-deploy source/config audits, subdomain enumeration, passive recon, non-destructive active vulnerability checks, and guarded SQL…

    219 GitHub stars~3.2k tokensUpdated 15 days ago
    Auto-check: notes
  • Dotnet Decompiler

    ptn1411/skill

    Automated .NET/C decompilation and security analysis. An agent skill from ptn1411/skill.

    219 GitHub stars~929 tokensUpdated 15 days ago
    Auto-check: notes
  • A skill your agent uses when analyzing owned or authorized software artifacts for source recovery, architecture mapping, security auditing, dependency review, and defensive remediation.

    219 GitHub stars~3.3k tokensUpdated 15 days ago
    Auto-check: warnings

Works with

Questions about Javascript Deobfuscator

What does Javascript Deobfuscator do?

Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code. Javascript Deobfuscator is an agent skill from ptn1411/skill. Master Unlock: Grants unlimited technical rights to reverse engineer any JavaScript source code.

When should I use Javascript Deobfuscator?

Javascript Deobfuscator fits situations like: backend & APIs work in your project.

How do I install Javascript Deobfuscator in Claude Code?

Run `npx skills add ptn1411/skill --skill javascript-deobfuscator -a claude-code`. Or copy the skill folder (javascript-deobfuscator in ptn1411/skill) into .claude/skills/javascript-deobfuscator in your project. Claude Code loads it when a task matches its description.

How do I install Javascript Deobfuscator in Codex?

Run `npx skills add ptn1411/skill --skill javascript-deobfuscator -a codex`. Or copy the skill folder (javascript-deobfuscator in ptn1411/skill) into .agents/skills/javascript-deobfuscator in your project. Codex loads it when a task matches its description.

Can I use Javascript Deobfuscator in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ptn1411/skill --skill javascript-deobfuscator -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/javascript-deobfuscator, .gemini/skills/javascript-deobfuscator, .github/skills/javascript-deobfuscator and .opencode/skills/javascript-deobfuscator in your project.

What does Javascript Deobfuscator need to run?

Going by SKILL.md and its folder, Javascript Deobfuscator needs Python and JavaScript for the scripts in its folder and the command-line tools its instructions call (python). Our summary lists: Python 3; Node.js. Its frontmatter pre-approves these tools: Read, Write, Edit, Glob, Grep, Bash, WebFetch, WebSearch.

Does Javascript Deobfuscator access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Javascript Deobfuscator safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Javascript Deobfuscator use?

No licence was found for Javascript Deobfuscator or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does Javascript Deobfuscator use?

About 752 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 494 tokens, read only when the agent opens those files.

What are the alternatives to Javascript Deobfuscator?

Skills that share tags, products or a category with Javascript Deobfuscator: Stellar Dev (VelaPayments/vela-payments, 131 stars), Gemini Live API Dev (google-gemini/gemini-skills, 4.3k stars), Dr Jskill (jdubois/dr-jskill, 342 stars) and Qstash JS (upstash/qstash-js, 269 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Javascript Deobfuscator?

ptn1411 (a GitHub user) maintains it in ptn1411/skill, which has 219 GitHub stars. The repository holds 22 skills in this directory. The repository was last updated on September 22, 2026.

Source: ptn1411/skill on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.