Web Reverse Engine

web-reverse-engine is a Codex Skill for mapping authorized Web or App crawler flows into evidence-backed, sanitized API graphs.

Main capabilities

• Identify prerequisite, primary, background, telemetry, and refresh requests.
• Trace response-to-request dependencies and ordinary parameter derivations.
• Analyze authorized HTML, JavaScript, WASM, HAR, JSONL, pcap, proxy, CDP, and runtime evidence.
• Diagnose divergence between an owned crawler and an authorized browser flow.
• Separate constants, runtime inputs, credentials, protection dependencies, and unresolved values.
• Produce a reviewable API graph before generating a high-level HTTP client.
• Keep browsers, target JavaScript execution, raw secrets, and protection implementations out of generated clients.

Safety boundary

Use the Skill only for user-owned or explicitly authorized targets and actions. It refuses credential/session theft or replay, authentication and access-control bypass, payment/licensing/DRM/CAPTCHA/risk-control evasion, identity or device spoofing, account abuse, stealth, and unauthorized analysis.

When a request crosses the boundary, detailed work stops before further collection, source inspection, debugging, hooks, replay, or client generation. The response is limited to a non-actionable functional overview, data categories, trust boundaries, defensive risks, and safe reframing options.

Ordinary algorithms remain allowed with public, synthetic, or user-owned inputs, including serialization, encoding, Base64, compression, timestamps, nonces, hashes, HMAC, and standard cryptographic primitives.

Output

The primary output is a sanitized API-flow graph containing:

• request ordering and roles;
• endpoint, method, status class, and media type;
• parameter locations and classifications;
• upstream/downstream field bindings;
• session continuity without secret values;
• ordinary derivation chains;
• credential and protection boundaries;
• unresolved dependencies, confidence, and evidence references.

Generated code is optional and comes only after the graph is coherent and safely validated.

Install for Codex

Link the complete web-reverse-engine/ source directory into the user Skill directory. The link must resolve to a directory whose top level directly contains SKILL.md; do not install by copying the source.

Windows PowerShell:

$skillsRoot = Join-Path $HOME ".agents\skills"
$source = (Resolve-Path "<repository-root>\web-reverse-engine").Path
$link = Join-Path $skillsRoot "web-reverse-engine"
New-Item -ItemType Directory -Force -Path $skillsRoot | Out-Null
if (Test-Path -LiteralPath $link) { throw "Destination already exists: $link" }
New-Item -ItemType Junction -Path $link -Target $source | Out-Null

macOS:

skills_root="$HOME/.agents/skills"
source_dir="$(cd "<repository-root>/web-reverse-engine" && pwd)"
link_path="$skills_root/web-reverse-engine"
mkdir -p "$skills_root"
if [ -e "$link_path" ] || [ -L "$link_path" ]; then echo "Destination already exists: $link_path" >&2; exit 1; fi
ln -s "$source_dir" "$link_path"

Codex normally detects Skill changes automatically; restart it if the Skill does not appear. Invoke it as $web-reverse-engine. For cross-agent reuse, CC Switch v3.13 or newer can use ~/.agents/skills as shared source storage: open Skills, scan/import the local Skill if needed, enable the target agents, and sync. Recheck safety restrictions, browser/tool availability, and permissions after import.

Files

• SKILL.md: executable Skill instructions.
• references/analysis-policy.md: authorization and sensitive-evidence handling.
• references/safety-boundaries.md: allowed/refused decision matrix.
• references/goal-contract.md: goal normalization and completion criteria.
• references/traffic-contract.md: canonical traffic evidence and sanitization.
• references/wasm-analysis.md: JavaScript/WebAssembly evidence levels.
• references/protected-runtime-analysis.md: bounded protected-runtime analysis.
• agents/openai.yaml: Skill UI metadata.