html_content_analysis_skill

Overview

This skill parses HTML to extract technology signals from meta generator tags, HTML comments, script and asset URLs, CSS classes, and JSON-LD structured data. It turns noisy page content into concise technology indicators and confidence scores for security research, bug bounty triage, and reconnaissance. The skill is tuned to detect CMS, frameworks, libraries, CSS frameworks, and common e-commerce or organization structured data.

How this skill works

The skill fetches HTML (respecting rate limits) and uses a lenient parser to locate <meta name="generator"> tags, HTML comments, <script> and <link> URLs, class attributes, and application/ld+json blocks. Pattern dictionaries map matched values to technologies with confidence scores and optional version extraction. Results include per-page evidence, a technologies summary, and detected structured-data types.

When to use it

• Passive reconnaissance during bug bounty or pentest scoping
• Quick inventory of technologies across target pages
• Prioritizing targets by likely platform or framework
• Detecting CMS versions or framework-specific endpoints for follow-up testing

Best practices

• Respect the page fetch rate limit per domain and use cached results when possible
• Treat detected signals as probabilistic — corroborate with additional checks before exploiting
• Sanitize and store only public-page extractions; do not execute any client-side scripts
• Limit parsing to the first few megabytes of HTML to avoid resource exhaustion and handle encoding robustly

Example use cases

• Find WordPress/Drupal/Joomla instances via meta generator or script paths
• Identify Next.js or Nuxt.js deployments from _next/_nuxt paths to infer React/Vue usage
• Spot CSS frameworks (Bootstrap, Tailwind) from class patterns to speed UI-focused testing
• Extract Product or Organization JSON-LD to confirm e-commerce or business targets
• Locate jquery/bootstrap references in script URLs to guide fingerprinted vulnerability checks