diff --git a/capabilities/web-security/agents/web-security.md b/capabilities/web-security/agents/web-security.md
index ac9da32..bc5bf30 100644
--- a/capabilities/web-security/agents/web-security.md
+++ b/capabilities/web-security/agents/web-security.md
@@ -122,7 +122,6 @@ You may also have tools from MCP servers. Check your tool schema for what's avai
 
 - **Proxy tools (Caido, Burp):** When a finding passes `assess_confidence`, replay the PoC through the available proxy to capture clean request/response evidence for the report. Use whichever proxy tools or programmatic approach fits the flow naturally.
 - **thermoptic**: Routes traffic through a TLS-fingerprint-resistant proxy. Useful when `execute_http` is blocked by bot detection or WAF fingerprinting.
-- **jxscout**: Finds **gadgets**, not vulnerabilities. Always trace data flow and confirm exploitability before reporting. Load the `jxscout-security-research` skill for the full workflow guide.
 - **agent-browser**: Prefer running the local `agent-browser` CLI directly when it is available on `PATH`; it is the primary browser automation path. **Always use a unique session name** (`--session <name>`) to avoid collisions with other agents or concurrent tasks sharing the same browser daemon — e.g. `agent-browser --session $(uuidgen || echo $$) open <url>`. Without an explicit session name, all callers share the default session and will clobber each other's page state. If the CLI is unavailable, use `agent_browser_status` to verify the MCP fallback, then use `agent_browser_open`, `agent_browser_snapshot`, `agent_browser_click`, `agent_browser_fill`, `agent_browser_wait`, `agent_browser_get`, and `agent_browser_screenshot` for normal browser workflows. Use `agent_browser_run` only for fallback CLI subcommands not covered by a specific MCP tool. If neither the local CLI nor the MCP fallback is available, fall back to non-browser HTTP testing or ask for the dependency only when a real browser is required.
 - **protoscope**: Prefer running the local `protoscope` CLI directly when it is available on `PATH`; it is the primary protobuf inspection and assembly path. If the CLI is unavailable, use `protoscope_status` to verify the MCP fallback. Use `protoscope_inspect_file` or `protoscope_inspect_hex` to decode binary protobuf payloads, and `protoscope_assemble_text` or `protoscope_assemble_file` to build binary protobuf bytes from Protoscope text. Use descriptor-set and message-type options when available to improve field names and enum output.
 - **hackerone**: Query HackerOne programs, scopes, reports, and hacktivity. Run `hackerone_health` first to verify credentials. Use `hackerone_get_program_scope` to enumerate in-scope assets before testing. Use `hackerone_search_hacktivity` to study previously disclosed vulnerabilities in a program. Use `hackerone_submit_report` only after the reporting pipeline completes (assess_confidence → report-preflight → exploit-verifier → report_item). Requires `H1_USERNAME` and `H1_API_TOKEN` env vars.
@@ -168,7 +167,7 @@ Before reporting any finding, complete this sequence:
 3. Load `exploit-verifier` skill — Run the Triple-Check (static viability, dynamic trigger, sink confirmation).
 4. Call `report_item` with type `web_vulnerability` — populate fields from your validated evidence. The schema enforces structure; fill what you have, leave optional fields empty when black-box testing doesn't yield them.
 
-If triaging batch findings from scanners or jxscout, load `vuln-critic` first to filter before entering this pipeline.
+If triaging batch findings from scanners, load `vuln-critic` first to filter before entering this pipeline.
 
 Do not skip steps 1-3. Do not report unverified findings.
 
diff --git a/capabilities/web-security/capability.yaml b/capabilities/web-security/capability.yaml
index db92478..1bfc72d 100644
--- a/capabilities/web-security/capability.yaml
+++ b/capabilities/web-security/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: web-security
-version: "1.15.1"
+version: "2.0.0"
 description: >
   Web application penetration testing with 83 attack technique playbooks
   covering HTTP desync/request smuggling, cache poisoning, SSRF, SSTI, DOM
@@ -18,7 +18,7 @@ description: >
   @caido/sdk-client / caido-ts) for curl-through-Caido
   testing, match & replace rules, and replay handoffs; Burp proxy
   integration via MCP, browser automation via
-  agent-browser, JS static analysis via jxscout, AST-based code pattern
+  agent-browser, AST-based code pattern
   search via ast-grep, protobuf inspection via
   protoscope, credential management, DNS rebinding, HTTP desync
   fingerprinting with byte-exact smuggling payload construction, blind
@@ -63,12 +63,6 @@ mcp:
         CAIDO_ACCESS_TOKEN: "${CAIDO_ACCESS_TOKEN:-}"
         CAIDO_ALLOW_SENSITIVE_HEADERS: "${CAIDO_ALLOW_SENSITIVE_HEADERS:-}"
       init_timeout: 60
-    jxscout:
-      command: "uv"
-      args:
-        - "run"
-        - "${CAPABILITY_ROOT}/mcp/jxscout.py"
-      init_timeout: 60
     thermoptic:
       command: "uv"
       args:
@@ -204,8 +198,6 @@ checks:
     command: command -v ast-grep
   - name: wrangler
     command: command -v wrangler
-  - name: jxscout
-    command: command -v jxscout-pro-v2
 
 author:
   name: Dreadnode
@@ -252,7 +244,6 @@ keywords:
   - agent-browser
   - browser-automation
   - burp-suite
-  - jxscout
   - ast-grep
   - interactsh
   - oob-callbacks
diff --git a/capabilities/web-security/docker/Dockerfile.runtime b/capabilities/web-security/docker/Dockerfile.runtime
index cac65b7..c6c7604 100644
--- a/capabilities/web-security/docker/Dockerfile.runtime
+++ b/capabilities/web-security/docker/Dockerfile.runtime
@@ -40,8 +40,7 @@
 #               as a cold-start aid.
 #
 # Tools NOT included (require external setup):
-#   - Burp    — set burp MCP url to a running instance
-#   - jxscout — commercial binary, requires license activation
+#   - Burp — set burp MCP url to a running instance
 
 FROM python:3.12-slim
 
diff --git a/capabilities/web-security/mcp/jxscout.py b/capabilities/web-security/mcp/jxscout.py
deleted file mode 100644
index ad82e9f..0000000
--- a/capabilities/web-security/mcp/jxscout.py
+++ /dev/null
@@ -1,502 +0,0 @@
-#!/usr/bin/env -S uv run
-# /// script
-# requires-python = ">=3.12"
-# dependencies = [
-#   "fastmcp>=2.0",
-# ]
-# ///
-"""jxscout tools — wraps jxscout-pro-v2 CLI and project SQLite databases.
-
-Provides JS analysis data: match queries, file listings, wordlist generation,
-findings, bookmarks, repeater, and asset relationships. Uses the CLI for
-write operations and complex queries, SQLite for fast reads.
-
-Requires:
-  - jxscout-pro-v2 binary on the host
-  - sqlite3 (stdlib, for fast database reads)
-"""
-
-from __future__ import annotations
-
-import asyncio
-import os
-import shutil
-import sqlite3
-from pathlib import Path
-from typing import Annotated
-
-from fastmcp import FastMCP
-
-JXSCOUT_HOME = Path.home() / ".jxscout-pro"
-JXSCOUT_BINARY = os.environ.get("JXSCOUT_BINARY", "jxscout-pro-v2")
-MAX_OUTPUT_CHARS = 50_000
-
-
-def _find_binary() -> str | None:
-    if shutil.which(JXSCOUT_BINARY):
-        return JXSCOUT_BINARY
-    for candidate in [
-        Path.home() / "go" / "bin" / "jxscout-pro-v2",
-        Path.home() / "bin" / "jxscout-pro-v2",
-    ]:
-        if candidate.exists():
-            return str(candidate)
-    return None
-
-
-def _project_db(project: str) -> Path:
-    return JXSCOUT_HOME / "projects" / project / "project.db"
-
-
-def _query_db(project: str, sql: str, params: tuple = ()) -> list[tuple]:
-    db_path = _project_db(project)
-    if not db_path.exists():
-        raise FileNotFoundError(f"Project '{project}' not found at {db_path}")
-    conn = sqlite3.connect(str(db_path))
-    try:
-        return conn.execute(sql, params).fetchall()
-    finally:
-        conn.close()
-
-
-async def _run_cli(args: list[str], timeout: int = 30) -> str:
-    binary = _find_binary()
-    if not binary:
-        return "Error: jxscout-pro-v2 binary not found. Set JXSCOUT_BINARY env var."
-    proc = await asyncio.create_subprocess_exec(
-        binary,
-        *args,
-        stdout=asyncio.subprocess.PIPE,
-        stderr=asyncio.subprocess.PIPE,
-    )
-    try:
-        stdout, stderr = await asyncio.wait_for(proc.communicate(), timeout=timeout)
-    except asyncio.TimeoutError:
-        proc.kill()
-        return f"Error: command timed out after {timeout}s"
-    output = stdout.decode(errors="replace")
-    if proc.returncode != 0:
-        err = stderr.decode(errors="replace")
-        return f"Error (exit {proc.returncode}): {err}"
-    return output[:MAX_OUTPUT_CHARS]
-
-
-mcp = FastMCP("jxscout")
-
-# ------------------------------------------------------------------
-# Database query tools (fast, no binary needed)
-# ------------------------------------------------------------------
-
-
-@mcp.tool
-async def jxscout_list_projects() -> str:
-    """List all jxscout projects."""
-    projects_dir = JXSCOUT_HOME / "projects"
-    if not projects_dir.exists():
-        return "No jxscout projects found."
-    projects = sorted(
-        d.name
-        for d in projects_dir.iterdir()
-        if d.is_dir() and (d / "project.db").exists()
-    )
-    if not projects:
-        return "No jxscout projects found."
-    return "\n".join(projects)
-
-
-@mcp.tool
-async def jxscout_match_summary(
-    project: Annotated[str, "Project name (e.g. 'postman')"],
-) -> str:
-    """Get match counts by kind for a project — start here for recon."""
-    try:
-        rows = _query_db(
-            project,
-            "SELECT match_kind, COUNT(*) as cnt FROM matches GROUP BY match_kind ORDER BY cnt DESC;",
-        )
-    except FileNotFoundError as e:
-        return str(e)
-    if not rows:
-        return "No matches found."
-    return "\n".join(f"{kind}\t{count}" for kind, count in rows)
-
-
-@mcp.tool
-async def jxscout_security_matches(
-    project: Annotated[str, "Project name"],
-    limit: Annotated[int, "Maximum results"] = 100,
-) -> str:
-    """Get all security-relevant matches (XSS sinks, secrets, postMessage, etc.) with file paths."""
-    security_kinds = (
-        "html_manipulation",
-        "dangerously_set_inner_html",
-        "window_onmessage",
-        "post_message",
-        "location_assignment",
-        "jwt",
-        "github_pat",
-        "stripe_secret_key",
-        "private_key",
-        "sensitive_property_name",
-        "hostname",
-        "graphql",
-    )
-    placeholders = ",".join("?" * len(security_kinds))
-    try:
-        rows = _query_db(
-            project,
-            f"""SELECT m.match_kind, m.match_value,
-                CASE ar.file_type
-                    WHEN 'js' THEN (SELECT fs_path FROM js_files WHERE id = ar.file_id)
-                    WHEN 'html' THEN (SELECT fs_path FROM html_files WHERE id = ar.file_id)
-                    WHEN 'reversed_source' THEN (SELECT reversed_fs_path FROM source_map_reversed_files WHERE id = ar.file_id)
-                END as file_path
-                FROM matches m
-                JOIN analysis_run ar ON m.analysis_run_id = ar.id
-                WHERE m.match_kind IN ({placeholders})
-                LIMIT ?;""",
-            (*security_kinds, limit),
-        )
-    except FileNotFoundError as e:
-        return str(e)
-    if not rows:
-        return "No security-relevant matches found."
-    return "\n".join(
-        f"{kind}\t{value}\t{path or '(unknown)'}" for kind, value, path in rows
-    )[:MAX_OUTPUT_CHARS]
-
-
-@mcp.tool
-async def jxscout_list_files(
-    project: Annotated[str, "Project name"],
-    file_type: Annotated[str, "File type: 'js', 'html', or 'reversed_source'"] = "js",
-    limit: Annotated[int, "Maximum results"] = 50,
-) -> str:
-    """List files tracked by jxscout for a project."""
-    table_map = {
-        "js": ("js_files", "id, url, fs_path"),
-        "html": ("html_files", "id, url, fs_path"),
-        "reversed_source": (
-            "source_map_reversed_files",
-            "id, reversed_fs_path, source_map_file_id",
-        ),
-    }
-    if file_type not in table_map:
-        return f"Error: file_type must be one of: {', '.join(table_map.keys())}"
-    table, cols = table_map[file_type]
-    try:
-        rows = _query_db(project, f"SELECT {cols} FROM {table} LIMIT ?;", (limit,))
-    except FileNotFoundError as e:
-        return str(e)
-    if not rows:
-        return f"No {file_type} files found."
-    return "\n".join("\t".join(str(c) for c in row) for row in rows)
-
-
-# ------------------------------------------------------------------
-# CLI wrapper tools (jxscout-pro-v2 -c)
-# ------------------------------------------------------------------
-
-
-@mcp.tool
-async def jxscout_list_match_kinds(
-    project: Annotated[str, "Project name"],
-) -> str:
-    """List all match kinds available in a project."""
-    return await _run_cli(
-        ["-c", "list-match-kinds", "--project-name", project, "--json"]
-    )
-
-
-@mcp.tool
-async def jxscout_get_matches(
-    project: Annotated[str, "Project name"],
-    match_kind: Annotated[
-        str, "Match kind (e.g. 'api_path', 'hostname', 'jwt', 'html_manipulation')"
-    ],
-    limit: Annotated[int, "Maximum results"] = 50,
-    show_only_unseen: Annotated[bool, "Only show unreviewed matches"] = False,
-    value_include: Annotated[
-        str | None, "Filter: match value must contain this string"
-    ] = None,
-) -> str:
-    """Get matches by kind with file paths and positions (JSON output)."""
-    args = [
-        "-c",
-        "get-matches",
-        "--project-name",
-        project,
-        "--match-kind",
-        match_kind,
-        "--json",
-        "--limit",
-        str(limit),
-    ]
-    if show_only_unseen:
-        args.append("--show-only-unseen")
-    if value_include:
-        args.extend(["--value-include", value_include])
-    return await _run_cli(args)
-
-
-@mcp.tool
-async def jxscout_mark_matches_seen(
-    project: Annotated[str, "Project name"],
-    match_ids: Annotated[str | None, "Comma-separated match IDs to mark seen"] = None,
-    match_kind: Annotated[str | None, "Mark all matches of this kind as seen"] = None,
-) -> str:
-    """Mark matches as seen/reviewed."""
-    args = ["-c", "mark-matches-seen", "--project-name", project]
-    if match_ids:
-        args.extend(["--match-ids", match_ids])
-    elif match_kind:
-        args.extend(["--match-kind", match_kind])
-    else:
-        return "Error: provide either match_ids or match_kind"
-    return await _run_cli(args)
-
-
-@mcp.tool
-async def jxscout_mark_matches_unseen(
-    project: Annotated[str, "Project name"],
-    match_ids: Annotated[str, "Comma-separated match IDs to mark unseen"],
-) -> str:
-    """Mark matches as unseen for re-review."""
-    return await _run_cli(
-        [
-            "-c",
-            "mark-matches-unseen",
-            "--project-name",
-            project,
-            "--match-ids",
-            match_ids,
-        ]
-    )
-
-
-@mcp.tool
-async def jxscout_wordlist(
-    project: Annotated[str, "Project name"],
-    limit: Annotated[int, "Maximum words"] = 200,
-    sort_by_count: Annotated[bool, "Sort by occurrence count"] = True,
-) -> str:
-    """Generate a fuzzing wordlist from JS analysis."""
-    args = ["-c", "wordlist", "--project-name", project, "--limit", str(limit)]
-    if sort_by_count:
-        args.append("--sort-by-count")
-    return await _run_cli(args)
-
-
-@mcp.tool
-async def jxscout_create_finding(
-    project: Annotated[str, "Project name"],
-    kind: Annotated[str, "Finding kind (e.g. 'xss', 'secret', 'idor')"],
-    severity: Annotated[str, "Severity: low, medium, high, critical"],
-    description: Annotated[str, "Finding description"],
-    dedup_key: Annotated[str | None, "Deduplication key"] = None,
-) -> str:
-    """Create a finding in jxscout."""
-    args = [
-        "-c",
-        "create-finding",
-        "--project-name",
-        project,
-        "--kind",
-        kind,
-        "--severity",
-        severity,
-        "--description",
-        description,
-    ]
-    if dedup_key:
-        args.extend(["--dedup-key", dedup_key])
-    return await _run_cli(args)
-
-
-@mcp.tool
-async def jxscout_get_findings(
-    project: Annotated[str, "Project name"],
-) -> str:
-    """List all findings in a project."""
-    return await _run_cli(["-c", "get-findings", "--project-name", project])
-
-
-@mcp.tool
-async def jxscout_get_finding(
-    project: Annotated[str, "Project name"],
-    finding_id: Annotated[int, "Finding ID"],
-) -> str:
-    """Get a specific finding by ID."""
-    return await _run_cli(
-        [
-            "-c",
-            "get-finding",
-            "--project-name",
-            project,
-            "--finding-id",
-            str(finding_id),
-        ]
-    )
-
-
-@mcp.tool
-async def jxscout_analyze_file(
-    project: Annotated[str, "Project name"],
-    file_path: Annotated[str, "Path to JS or HTML file"],
-    file_type: Annotated[str, "File type: js, html, reversed_source"] = "js",
-) -> str:
-    """Run ad-hoc analysis on a file."""
-    return await _run_cli(
-        [
-            "-c",
-            "analyze",
-            "--project-name",
-            project,
-            "--file-type",
-            file_type,
-            file_path,
-        ],
-        timeout=60,
-    )
-
-
-@mcp.tool
-async def jxscout_get_loaded_js_files(
-    project: Annotated[str, "Project name"],
-    page_url: Annotated[str, "Page URL to check which JS files it loads"],
-) -> str:
-    """Get JS files loaded by a specific page URL."""
-    return await _run_cli(
-        ["-c", "get-loaded-js-files", "--project-name", project, page_url, "--json"]
-    )
-
-
-@mcp.tool
-async def jxscout_get_js_file_loader_page(
-    project: Annotated[str, "Project name"],
-    file_path: Annotated[str, "Path to JS file"],
-) -> str:
-    """Get which pages load a specific JS file."""
-    return await _run_cli(
-        [
-            "-c",
-            "get-js-file-loader-page",
-            "--project-name",
-            project,
-            file_path,
-            "--json",
-        ]
-    )
-
-
-@mcp.tool
-async def jxscout_get_loaded_iframes(
-    project: Annotated[str, "Project name"],
-    page_url: Annotated[str, "Page URL to check for embedded iframes"],
-) -> str:
-    """Get iframes embedded by a specific page."""
-    return await _run_cli(
-        ["-c", "get-loaded-iframes", "--project-name", project, page_url, "--json"]
-    )
-
-
-@mcp.tool
-async def jxscout_get_related_assets(
-    project: Annotated[str, "Project name"],
-    file_path: Annotated[str, "Path to file"],
-) -> str:
-    """Get full relationship graph for a file."""
-    return await _run_cli(
-        ["-c", "get-related-assets", "--project-name", project, file_path, "--json"]
-    )
-
-
-@mcp.tool
-async def jxscout_bookmark_create_group(
-    project: Annotated[str, "Project name"],
-    name: Annotated[str, "Bookmark group name"],
-) -> str:
-    """Create a bookmark group."""
-    return await _run_cli(
-        ["-c", "bookmark", "create-group", "--project-name", project, "--name", name]
-    )
-
-
-@mcp.tool
-async def jxscout_bookmark_create(
-    project: Annotated[str, "Project name"],
-    group: Annotated[str, "Bookmark group name"],
-    file_path: Annotated[str, "Path to file"],
-    start_line: Annotated[int, "Start line number"],
-    end_line: Annotated[int, "End line number"],
-    note: Annotated[str | None, "Note explaining why this code is interesting"] = None,
-    start_column: Annotated[int, "Start column"] = 0,
-    end_column: Annotated[int, "End column"] = 0,
-) -> str:
-    """Create a bookmark on a code location."""
-    args = [
-        "-c",
-        "bookmark",
-        "create",
-        "--project-name",
-        project,
-        "--group",
-        group,
-        "--file-path",
-        file_path,
-        "--start-line",
-        str(start_line),
-        "--start-column",
-        str(start_column),
-        "--end-line",
-        str(end_line),
-        "--end-column",
-        str(end_column),
-    ]
-    if note:
-        args.extend(["--note", note])
-    return await _run_cli(args)
-
-
-@mcp.tool
-async def jxscout_repeater(
-    project: Annotated[str, "Project name"],
-    request_file: Annotated[str, "Path to .req file to send"],
-) -> str:
-    """Send a raw HTTP request via jxscout repeater."""
-    return await _run_cli(
-        ["-c", "repeater", "--project-name", project, request_file], timeout=30
-    )
-
-
-@mcp.tool
-async def jxscout_retrigger_events(
-    project: Annotated[str, "Project name"],
-    subscriber: Annotated[str, "Subscriber to retrigger (e.g. 'analyzer')"],
-) -> str:
-    """Retrigger events for a subscriber (e.g. after adding custom analyzers)."""
-    return await _run_cli(
-        [
-            "-c",
-            "retrigger-events",
-            "--project-name",
-            project,
-            "--subscriber",
-            subscriber,
-        ],
-        timeout=120,
-    )
-
-
-@mcp.tool
-async def jxscout_print_settings(
-    project: Annotated[str, "Project name"],
-) -> str:
-    """Print the full resolved project settings."""
-    return await _run_cli(
-        ["-c", "print-full-project-settings", "--project-name", project]
-    )
-
-
-if __name__ == "__main__":
-    mcp.run(transport="stdio")
diff --git a/capabilities/web-security/scripts/install_tools.sh b/capabilities/web-security/scripts/install_tools.sh
index 05ce566..a95a2c1 100755
--- a/capabilities/web-security/scripts/install_tools.sh
+++ b/capabilities/web-security/scripts/install_tools.sh
@@ -219,18 +219,6 @@ BURPEOF
   fi
 fi
 
-# -- jxscout ----------------------------------------------------------------
-# Commercial binary — if JXSCOUT_BINARY_URL is set, download from there.
-# Otherwise skip; the MCP server falls back to PATH / ~/go/bin / ~/bin.
-if ! command -v jxscout-pro-v2 &>/dev/null && [ -n "${JXSCOUT_BINARY_URL:-}" ]; then
-  curl -fsSL "$JXSCOUT_BINARY_URL" -o /tmp/jxscout-pro-v2 \
-    && as_root install -m 0755 /tmp/jxscout-pro-v2 /usr/local/bin/jxscout-pro-v2
-  rm -f /tmp/jxscout-pro-v2
-  echo "jxscout installed from JXSCOUT_BINARY_URL"
-elif ! command -v jxscout-pro-v2 &>/dev/null; then
-  echo "WARN: jxscout-pro-v2 not found. Set JXSCOUT_BINARY_URL to install, or place binary on PATH."
-fi
-
 # -- exiftool (EXIF metadata manipulation) ---------------------------------
 if ! command -v exiftool &>/dev/null; then
   as_root apt-get install -y --no-install-recommends libimage-exiftool-perl \
diff --git a/capabilities/web-security/skills/csp-bypass/SKILL.md b/capabilities/web-security/skills/csp-bypass/SKILL.md
index b0345fd..e1034bc 100644
--- a/capabilities/web-security/skills/csp-bypass/SKILL.md
+++ b/capabilities/web-security/skills/csp-bypass/SKILL.md
@@ -57,9 +57,6 @@ If CSP whitelists a domain that has a JSONP endpoint, inject a `<script>` tag po
 
 **To find JSONP endpoints on any whitelisted domain**:
 ```bash
-# Search for JSONP patterns in JS files via jxscout
-jxscout-pro-v2 -c get-matches --kind jsonp-endpoint
-
 # Probe common JSONP paths
 for p in "/api?callback=test" "/?callback=test" "/search?jsonp=test" \
          "/v1/endpoint?cb=test" "/?_jsonp=test"; do
@@ -248,9 +245,6 @@ for p in "?callback=alert" "?cb=alert" "?jsonp=alert" "?_callback=alert" \
          "?onload=alert" "?_jsonp=alert" "?func=alert"; do
   curl -sk "https://whitelisted-domain.com/api${p}" | head -1
 done
-
-# Check jxscout for JSONP patterns in target JS
-jxscout-pro-v2 -c get-matches --kind jsonp-endpoint
 ```
 
 ### Philosophy
diff --git a/capabilities/web-security/skills/cspt-xss/SKILL.md b/capabilities/web-security/skills/cspt-xss/SKILL.md
index f321b5f..bdf325d 100644
--- a/capabilities/web-security/skills/cspt-xss/SKILL.md
+++ b/capabilities/web-security/skills/cspt-xss/SKILL.md
@@ -348,12 +348,6 @@ axios.get(`/api/v1/${resource}/${id}`)          // resource + id from URL
 $.get(`/data/${window.location.hash.slice(1)}`) // hash fragment
 ```
 
-**Detection with jxscout:**
-```bash
-jxscout-pro-v2 -c get-matches --kind fetch-url-injection
-jxscout-pro-v2 -c get-matches --kind dynamic-api-path
-```
-
 **Manual grep patterns:**
 ```bash
 # In downloaded JS bundles
diff --git a/capabilities/web-security/skills/dom-vulnerability-detection/SKILL.md b/capabilities/web-security/skills/dom-vulnerability-detection/SKILL.md
index 304f2d6..9fe5aed 100644
--- a/capabilities/web-security/skills/dom-vulnerability-detection/SKILL.md
+++ b/capabilities/web-security/skills/dom-vulnerability-detection/SKILL.md
@@ -169,7 +169,7 @@ https://target.com/page#<img src=x onerror=alert(document.domain)>
 
 ## Optional: bulk-triage listener bodies with FransyTracker's ruleset
 
-When you have harvested many listener bodies (jxscout, `agent-browser eval`, source review), you can
+When you have harvested many listener bodies (`agent-browser eval`, source review), you can
 machine-triage them before reading each by hand. [FransyTracker](https://gitlab.com/joaxcar/fransytracker)'s
 rules engine is a self-contained module with no Chrome or DOM dependency, so it runs standalone:
 
diff --git a/capabilities/web-security/skills/dom-vulnerability-static-analysis/SKILL.md b/capabilities/web-security/skills/dom-vulnerability-static-analysis/SKILL.md
index 6a16d54..49a2326 100644
--- a/capabilities/web-security/skills/dom-vulnerability-static-analysis/SKILL.md
+++ b/capabilities/web-security/skills/dom-vulnerability-static-analysis/SKILL.md
@@ -105,7 +105,7 @@ ast-grep -p 'dangerouslySetInnerHTML={{$VAR}}' -l tsx src/
 ast-grep -p '$EL.html($CONTENT)' -l js src/
 ```
 
-Add `--json` to any command for structured output with file paths, line/column positions, and captured metavariable values. This is useful for programmatic triage or feeding results into jxscout custom analyzers.
+Add `--json` to any command for structured output with file paths, line/column positions, and captured metavariable values. This is useful for programmatic triage.
 
 ### Additional AST tools (if operator-installed)
 
diff --git a/capabilities/web-security/skills/jxscout-bookmarks/SKILL.md b/capabilities/web-security/skills/jxscout-bookmarks/SKILL.md
deleted file mode 100644
index 84bb80f..0000000
--- a/capabilities/web-security/skills/jxscout-bookmarks/SKILL.md
+++ /dev/null
@@ -1,120 +0,0 @@
----
-name: jxscout-bookmarks
-description: Create jxscout bookmarks and bookmark groups via the CLI to document interesting code during security research. Use when analyzing JS/HTML files, reviewing findings, documenting client-side flows, or when the user asks to bookmark security-relevant code patterns, gadgets, or sinks.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-# jxscout Bookmarks
-
-Bookmark interesting code during security research -- client-side flows, sinks, gadgets, postMessage handlers, authentication logic, request construction patterns, etc. Bookmarks appear in the VS Code extension sidebar with highlight decorations and markdown notes.
-
-jxscout works with JS, HTML, and HTTP-related files. Bookmarks should point to code in these web assets.
-
-## Prerequisites
-
-The `JXSCOUT_PROJECT_NAME` environment variable must be set. It is available in the project's `.env` file at the root of the working directory. All commands use `jxscout-pro-v2 -c` (client mode).
-
-## Commands
-
-### Groups
-
-#### List existing groups
-
-```bash
-jxscout-pro-v2 -c bookmark list-groups
-```
-
-Returns JSON array of `{ id, name, highlight_color, created_at }`.
-
-#### Create a group
-
-```bash
-jxscout-pro-v2 -c bookmark create-group --name "postMessage handlers" --highlight-color "rgba(255,165,0,0.15)"
-```
-
-- `--name` -- descriptive category name
-- `--highlight-color` -- optional CSS color string for code highlighting in VS Code (e.g. `rgba(255,0,0,0.1)`)
-
-Returns JSON with the created group.
-
-#### Update a group
-
-```bash
-jxscout-pro-v2 -c bookmark update-group --name "Old Name" --new-name "New Name" --highlight-color "rgba(0,255,0,0.1)"
-```
-
-Pass empty string to `--highlight-color` to clear it.
-
-#### Delete a group
-
-```bash
-jxscout-pro-v2 -c bookmark delete-group --name "Group Name"
-```
-
-Deletes the group and all bookmarks in it.
-
-### Bookmarks
-
-#### Create a bookmark
-
-```bash
-jxscout-pro-v2 -c bookmark create \
-  --group "postMessage handlers" \
-  --file-path /absolute/path/to/file.js \
-  --start-line 10 --start-column 0 \
-  --end-line 15 --end-column 42 \
-  --note "Accepts messages from any origin, passes event.data.url to location.href"
-```
-
-- `--group` -- group name (must already exist)
-- `--file-path` -- absolute path to the file
-- `--start-line`, `--end-line` -- 1-indexed line numbers
-- `--start-column`, `--end-column` -- 0-indexed column numbers
-- `--note` -- optional, supports markdown
-
-#### List bookmarks
-
-```bash
-jxscout-pro-v2 -c bookmark list [--group "Group Name"] [--file-path /path/to/file.js]
-```
-
-Returns JSON array of all bookmarks, optionally filtered by group or file path.
-
-#### Update a bookmark
-
-```bash
-jxscout-pro-v2 -c bookmark update --id <bookmark_id> [--group "New Group"] [--note "Updated note"] [--file-path /new/path] [--start-line N --start-column N --end-line N --end-column N]
-```
-
-Pass empty string to `--note` to clear it.
-
-#### Delete a bookmark
-
-```bash
-jxscout-pro-v2 -c bookmark delete --id <bookmark_id>
-```
-
-## Workflow
-
-1. Check existing groups: `jxscout-pro-v2 -c bookmark list-groups`
-2. Create a group if none fits: `jxscout-pro-v2 -c bookmark create-group --name "XSS sinks"`
-3. Create bookmarks with notes as you find interesting code
-
-**Checkpoint:** After creating a group, run `bookmark list-groups` to verify. After creating bookmarks, run `bookmark list --group "Name"` to confirm.
-
-## What to bookmark
-
-Sinks, message handlers without origin checks, auth logic, request construction with user-controlled params, JSONP callbacks, DOM clobbering targets, multi-step flows (bookmark each step in same group with progression notes).
-
-Bookmarks can also point to raw `.req`/`.res` files in `http_requests/` for marking interesting API calls or auth flows.
-
-## Note guidelines
-
-Notes should explain **why** the code is interesting. Notes support markdown.
-
-- Good: "postMessage handler -- no origin check, passes `event.data.redirect` to `window.location`"
-- Bad: "Event listener"
diff --git a/capabilities/web-security/skills/jxscout-custom-analyzers/SKILL.md b/capabilities/web-security/skills/jxscout-custom-analyzers/SKILL.md
deleted file mode 100644
index e228aad..0000000
--- a/capabilities/web-security/skills/jxscout-custom-analyzers/SKILL.md
+++ /dev/null
@@ -1,391 +0,0 @@
----
-name: jxscout-custom-analyzers
-description: Create custom jxscout analyzers (regex, derived, or script-based) and retrigger analysis. Use when the user wants to find specific code patterns across all project files, add new match kinds, or extend jxscout's static analysis capabilities.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-# jxscout Custom Analyzers
-
-jxscout supports custom analyzers that you can add to a project's configuration. These run alongside the built-in analyzers and generate new match kinds that appear in the VS Code extension and are queryable via `get-matches`.
-
-There are three types: **regex**, **derived**, and **script**. All are configured in the project's `settings.jsonc` under `analyzer > custom_analyzers`.
-
-## Prerequisites
-
-The `JXSCOUT_PROJECT_NAME` environment variable must be set. The project settings file is at `<working_directory>/settings.jsonc`. All commands use `jxscout-pro-v2 -c` (client mode).
-
-## Choosing the right analyzer type
-
-For JS/TS code pattern matching (function calls, assignments, data flow, control structures), **prefer AST-based analysis via script analyzers** over regex. Regex works for simple literal patterns -- hardcoded URLs, API keys, specific strings -- but is fragile for code constructs because it misses variations in whitespace, formatting, nesting, and comments.
-
-Rule of thumb:
-- **Regex**: simple string patterns that don't depend on code structure
-- **Derived**: narrowing down an existing match kind by value
-- **Script (ast-grep)**: anything involving code semantics -- function calls, assignments, data flow, missing checks. Installed in the runtime, use this by default.
-- **Script (semgrep)**: same use case as ast-grep, with additional taint tracking in semgrep Pro. Only available if operator-installed.
-
-## Analyzer types
-
-### Regex analyzer
-
-Pattern-matches source code with one or more regexes. Good for simple literal patterns (URLs, API keys, specific strings) but fragile for code constructs.
-
-```json
-{
-  "analyzer": {
-    "custom_analyzers": {
-      "sensitive_fetch": {
-        "enabled": true,
-        "type": "regex",
-        "file_types": ["js", "reversed_source"],
-        "match_kind": "sensitive_fetch",
-        "regex_list": ["fetch\\s*\\([^)]*\\/api\\/admin", "fetch\\s*\\([^)]*\\/internal"]
-      }
-    }
-  }
-}
-```
-
-- `file_types`: which files to scan -- `js`, `html`, `reversed_source`
-- `match_kind`: the kind string for generated matches
-- `regex_list`: array of regex patterns
-
-### Derived analyzer
-
-Filters an existing match kind to create a new, more specific one. Useful for flagging specific values within a broader match kind.
-
-```json
-{
-  "analyzer": {
-    "custom_analyzers": {
-      "admin_paths": {
-        "enabled": true,
-        "type": "derived",
-        "file_types": ["js", "html", "reversed_source"],
-        "original_match_kind": "path",
-        "new_match_kind": "admin_path",
-        "regex_list": [".*admin.*", ".*internal.*", ".*debug.*"]
-      }
-    }
-  }
-}
-```
-
-- `original_match_kind`: the source match kind to derive from
-- `new_match_kind`: the new match kind to create
-- `regex_list`: if any regex matches the original value, a derived match is created
-- `preprocess_script`: optional script that receives the match value on stdin and outputs the transformed value (or nothing to skip)
-
-### Script analyzer
-
-Runs an arbitrary script that receives file paths on stdin and outputs matches as JSON. Most flexible -- use for complex analysis like AST-based pattern matching.
-
-```json
-{
-  "analyzer": {
-    "custom_analyzers": {
-      "semgrep_postmessage": {
-        "enabled": true,
-        "type": "script",
-        "file_types": ["js", "reversed_source"],
-        "script": "$JXSCOUT_PROJECT_DIR/scripts/semgrep_to_jxscout.sh --rule $JXSCOUT_PROJECT_DIR/semgrep/postmessage.yaml --kind postmessage_handler"
-      }
-    }
-  }
-}
-```
-
-The script receives file paths on stdin (one per line) and must output a JSON array:
-
-```json
-[
-  {
-    "kind": "postmessage_handler",
-    "value": "window.addEventListener('message', function(e) { ... })",
-    "start": { "line": 10, "column": 0 },
-    "end": { "line": 15, "column": 1 }
-  }
-]
-```
-
-`$JXSCOUT_PROJECT_DIR` and `$JXSCOUT_PROJECT_NAME` are available as environment variables in all scripts.
-
-## Using ast-grep for JS analysis (installed in runtime)
-
-ast-grep uses tree-sitter for AST-based structural code matching. Patterns use real code syntax with `$VAR` wildcards -- far more accurate than regex for function calls, assignments, and nested expressions. Prefer ast-grep over regex for script analyzers.
-
-### 1. Create the wrapper script
-
-Create `scripts/ast_grep_to_jxscout.sh` in your project directory. This script converts ast-grep JSON output to the jxscout match format:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-PATTERN=""
-KIND=""
-LANG="javascript"
-
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    -p|--pattern) PATTERN="$2"; shift 2 ;;
-    -k|--kind) KIND="$2"; shift 2 ;;
-    -l|--lang) LANG="$2"; shift 2 ;;
-    *) echo "Usage: $0 -p|--pattern <pattern> -k|--kind <kind> [-l|--lang <lang>] (file paths on stdin)" >&2; exit 1 ;;
-  esac
-done
-
-[[ -n "$PATTERN" ]] || { echo "Missing -p|--pattern <pattern>" >&2; exit 1; }
-[[ -n "$KIND" ]] || { echo "Missing -k|--kind <kind>" >&2; exit 1; }
-
-FILES=()
-while IFS= read -r line || [[ -n "$line" ]]; do
-  [[ -n "$line" ]] && FILES+=("$line")
-done
-
-[[ ${#FILES[@]} -gt 0 ]] || { echo "No file paths on stdin" >&2; exit 1; }
-
-output=""
-for f in "${FILES[@]}"; do
-  AG_JSON=$(ast-grep -p "$PATTERN" -l "$LANG" --json "$f" 2>/dev/null || echo "[]")
-  while IFS= read -r result; do
-    one=$(echo "$result" | jq -c \
-      --arg kind "$KIND" \
-      '{kind: $kind, value: .text, start: {line: (.range.start.line + 1), column: .range.start.column}, end: {line: (.range.end.line + 1), column: .range.end.column}}')
-    output="${output}${one}"$'\n'
-  done < <(echo "$AG_JSON" | jq -c '.[]? // empty')
-done
-
-if [[ -z "$output" ]]; then
-  echo "[]"
-else
-  echo "$output" | jq -cs 'if . == null then [] else . end'
-fi
-```
-
-Make it executable: `chmod +x scripts/ast_grep_to_jxscout.sh`
-
-**Note:** ast-grep uses 0-based line numbers; the script adds 1 to align with jxscout's 1-based convention.
-
-### 2. Add to project settings
-
-```json
-{
-  "analyzer": {
-    "custom_analyzers": {
-      "innerHTML_sink": {
-        "enabled": true,
-        "type": "script",
-        "file_types": ["js", "reversed_source"],
-        "script": "$JXSCOUT_PROJECT_DIR/scripts/ast_grep_to_jxscout.sh --pattern '$EL.innerHTML = $VAR' --kind innerHTML_sink"
-      }
-    }
-  }
-}
-```
-
-### 3. Multiple patterns
-
-For analyzers that need several patterns (e.g. all eval-family sinks), create one analyzer per pattern with a shared match kind, or write a wrapper that runs ast-grep multiple times and merges the output.
-
-## Using semgrep for JS analysis (if operator-installed)
-
-When semgrep is available and you need taint tracking or data-flow analysis beyond structural matching, use it as a script analyzer. Semgrep is not installed in the runtime by default.
-
-### 1. Create a semgrep rule
-
-Create a YAML rule file in your project (e.g. `semgrep/postmessage_no_origin.yaml`):
-
-```yaml
-rules:
-  - id: postmessage-no-origin-check
-    message: postMessage handler without origin check
-    pattern: |
-      window.addEventListener("message", function($EVENT) {
-        ...
-      })
-    languages: [javascript, typescript]
-    severity: WARNING
-```
-
-### 2. Create the wrapper script
-
-Create `scripts/semgrep_to_jxscout.sh` in your project directory. This script converts semgrep JSON output to the jxscout match format:
-
-```bash
-#!/usr/bin/env bash
-set -euo pipefail
-
-RULE_PATH=""
-KIND=""
-
-while [[ $# -gt 0 ]]; do
-  case $1 in
-    -r|--rule) RULE_PATH="$2"; shift 2 ;;
-    -k|--kind) KIND="$2"; shift 2 ;;
-    *) echo "Usage: $0 -r|--rule <rule_path> -k|--kind <kind> (file paths on stdin)" >&2; exit 1 ;;
-  esac
-done
-
-[[ -n "$RULE_PATH" ]] || { echo "Missing -r|--rule <path>" >&2; exit 1; }
-[[ -n "$KIND" ]] || { echo "Missing -k|--kind <kind>" >&2; exit 1; }
-
-FILES=()
-while IFS= read -r line || [[ -n "$line" ]]; do
-  [[ -n "$line" ]] && FILES+=("$line")
-done
-
-[[ ${#FILES[@]} -gt 0 ]] || { echo "No file paths on stdin" >&2; exit 1; }
-
-SEMGREP_JSON=$(semgrep scan --config "$RULE_PATH" "${FILES[@]}" --json --quiet)
-
-output=""
-while IFS= read -r result; do
-  path=$(echo "$result" | jq -r '.path')
-  start_offset=$(echo "$result" | jq -r '.start.offset')
-  end_offset=$(echo "$result" | jq -r '.end.offset')
-  start_line=$(echo "$result" | jq -r '.start.line')
-  start_col=$(echo "$result" | jq -r '.start.col')
-  end_line=$(echo "$result" | jq -r '.end.line')
-  end_col=$(echo "$result" | jq -r '.end.col')
-
-  value=$(tail -c +$((start_offset + 1)) "$path" | head -c $((end_offset - start_offset)))
-
-  one=$(jq -cn \
-    --arg kind "$KIND" \
-    --arg value "$value" \
-    --argjson start_line "$start_line" \
-    --argjson start_col "$start_col" \
-    --argjson end_line "$end_line" \
-    --argjson end_col "$end_col" \
-    '{kind: $kind, value: $value, start: {line: $start_line, column: $start_col}, end: {line: $end_line, column: $end_col}}')
-  output="${output}${one}"$'\n'
-done < <(echo "$SEMGREP_JSON" | jq -c '.results[]? // empty')
-
-if [[ -z "$output" ]]; then
-  echo "[]"
-else
-  echo "$output" | jq -cs 'if . == null then [] else . end'
-fi
-```
-
-Make it executable: `chmod +x scripts/semgrep_to_jxscout.sh`
-
-### 3. Add to project settings
-
-```json
-{
-  "analyzer": {
-    "custom_analyzers": {
-      "postmessage_no_origin": {
-        "enabled": true,
-        "type": "script",
-        "file_types": ["js", "reversed_source"],
-        "script": "$JXSCOUT_PROJECT_DIR/scripts/semgrep_to_jxscout.sh --rule $JXSCOUT_PROJECT_DIR/semgrep/postmessage_no_origin.yaml --kind postmessage_no_origin"
-      }
-    }
-  }
-}
-```
-
-## Testing analyzers
-
-**Always test every new or modified analyzer before retriggering project-wide.** Use the `analyze` command on a single file:
-
-```bash
-jxscout-pro-v2 -c analyze --file-type <js|html|reversed_source> <file_path>
-```
-
-This outputs the matches that would be generated but does **not** store them in the database.
-
-If no file in the project contains the pattern you're targeting, create a small temporary test file with known patterns that should match, run `analyze` against it, verify the output is correct, and delete the temp file. This ensures the analyzer actually works before committing to a potentially long retrigger across the full project.
-
-## Retriggering analysis
-
-After adding or modifying analyzers, retrigger analysis to regenerate matches across the project:
-
-```bash
-jxscout-pro-v2 -c retrigger-events --subscriber analyzer [options]
-```
-
-Options:
-- `--glob <pattern>` -- only retrigger for files matching a glob (e.g. `*.js`, `/path/to/*.html`)
-- `--event-name <name>` -- filter by event name (repeatable)
-- `--status <status>` -- filter by status: `done`, `failed`, `killed` (repeatable)
-- `--json` -- output result as JSON
-
-**Always retrigger after adding or modifying an analyzer** -- without this, the new matches won't exist in the database. Only skip retriggering if the user explicitly says they don't want to. On large projects you can mention it may take a while, but proceed unless told otherwise. Use `--glob` to scope the retrigger to specific files or directories if the user wants a faster, targeted run.
-
-To see what subscribers and events are available:
-
-```bash
-jxscout-pro-v2 -c list-subscribers --json
-```
-
-## Updating the VS Code matches view
-
-**You must always add new match kinds to the VS Code matches view.** Without this step, the analyzer's results won't be visible in the sidebar and the analyzer is effectively useless to the user.
-
-**CRITICAL: Before adding a match kind, you MUST check whether `vscode_extension` already exists in `settings.jsonc`.** If it does NOT exist, you MUST first copy the entire `vscode_extension` block from the full project settings into `settings.jsonc`. If you skip this and only add the new match kind entry, **all built-in match kinds will disappear from the VS Code sidebar** because the override replaces the defaults entirely.
-
-### Step 1: Ensure `vscode_extension` is in `settings.jsonc`
-
-Check `settings.jsonc` for a `vscode_extension` key. If it is **not** present:
-
-1. Run `jxscout-pro-v2 -c print-full-project-settings`
-2. Copy the **entire** `vscode_extension` block from the output into `settings.jsonc`
-3. Only then proceed to add your new match kind
-
-This preserves all existing built-in match kinds (paths, URLs, secrets, sinks, etc.) in the sidebar. **Never skip this step** -- adding only the new entry without the existing structure will remove every other match kind from the view.
-
-If `vscode_extension > matches_view > structure` already exists in `settings.jsonc`, skip to step 2.
-
-### Step 2: Add your match kind to the view
-
-Append an entry like this to the `vscode_extension > matches_view > structure` array:
-
-```json
-{
-  "type": "navigation",
-  "label": "Sensitive Fetches",
-  "icon": "vscode:shield",
-  "children": [
-    {
-      "type": "match",
-      "match_kind": "sensitive_fetch",
-      "icon": "vscode:shield",
-      "dont_collapse_individual_matches": true
-    }
-  ]
-}
-```
-
-- `type`: `"navigation"` for tree nodes, `"match"` for leaves that show actual matches
-- `match_kind`: must match the kind string from your analyzer config
-- `icon`: use `jxscout:<name>` for built-in icons, `vscode:<name>` for VS Code icons, or `file:/path/to/icon.svg` for custom SVGs
-- `dont_collapse_individual_matches`: controls whether matches with the same value are collapsed into one tree node or shown individually (see below)
-
-### Collapsing vs. showing individual matches
-
-By default, matches with the same value are collapsed into a single tree node (e.g. if `/api/users` appears in 5 files, you see one `/api/users` node). This is useful for value-oriented match kinds where the value itself is what matters -- paths, URLs, hostnames, query params, secrets.
-
-For source/sink analyzers, collapsing is **wrong**. Two matches like `document.innerHTML = e` can have the same textual value but represent completely different code locations with different variables, contexts, and security implications. Set `"dont_collapse_individual_matches": true` so every match gets its own node.
-
-Rule of thumb:
-- **Collapse** (default, or `false`): the match value alone tells you everything -- paths, URLs, hostnames, secrets, query params
-- **Don't collapse** (`true`): the match value is a code snippet where the surrounding context matters -- sinks (`innerHTML`, `eval`), event handlers (`onmessage`), assignments, function calls
-
-jxscout auto-reloads when `settings.jsonc` changes, so the view updates immediately after saving.
-
-## Workflow for adding a custom analyzer
-
-1. Decide the analyzer type: regex for simple literal patterns, derived for filtering existing match kinds, script for code-semantic analysis (prefer ast-grep for JS/TS structural matching; use semgrep if operator-installed and taint tracking is needed)
-2. Add the configuration to `settings.jsonc` under `analyzer > custom_analyzers`
-3. Test with `analyze` on a file that should match (create a temp test file if needed, then delete it)
-4. **Always** add the new match kind to the VS Code matches view -- **first ensure the full `vscode_extension` block is in `settings.jsonc`** (get it from `print-full-project-settings` if missing), then append your entry
-5. **Always** retrigger analysis with `retrigger-events --subscriber analyzer` (skip only if the user explicitly says not to)
-6. Query results with `get-matches --match-kind <your_kind> --json`
diff --git a/capabilities/web-security/skills/jxscout-findings/SKILL.md b/capabilities/web-security/skills/jxscout-findings/SKILL.md
deleted file mode 100644
index 7e76593..0000000
--- a/capabilities/web-security/skills/jxscout-findings/SKILL.md
+++ /dev/null
@@ -1,116 +0,0 @@
----
-name: jxscout-findings
-description: Create, retrieve, and list jxscout findings to document security-relevant discoveries. Use when you've identified a vulnerability, interesting gadget, security-relevant primitive, or anything a bug bounty hunter would want to track. Also use when the user wants to review, list, filter, or summarize existing findings.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-# jxscout Findings
-
-Findings are how you document security-relevant discoveries in a jxscout project. They persist in the project database and are visible across tools.
-
-## What deserves a finding
-
-Create findings for things that have **real security value**:
-
-- Confirmed vulnerabilities (XSS, IDOR, SSRF, open redirect, etc.)
-- Interesting gadgets or primitives that could be chained into exploits (JSONP endpoints, postMessage handlers without origin checks, DOM clobbering gadgets, controllable redirect parameters)
-- Security-relevant misconfigurations (missing CORS restrictions, overly permissive CSP, exposed debug endpoints)
-- Sensitive data exposure (hardcoded secrets, API keys, internal URLs)
-
-The bar is: **would a security researcher find this useful?** Not just full exploits -- useful building blocks count too.
-
-**What to avoid**: purely theoretical risks with no supporting evidence. "This file uses eval()" is not a finding unless you can show how user input reaches it. Generic observations without context on exploitability or reachability are noise.
-
-## Prerequisites
-
-The `JXSCOUT_PROJECT_NAME` environment variable must be set. All commands use `jxscout-pro-v2 -c` (client mode).
-
-## Commands
-
-### Create a finding
-
-```bash
-jxscout-pro-v2 -c create-finding \
-  --kind <kind> \
-  --severity <low|medium|high|critical> \
-  --description "What was found, where, and why it matters" \
-  --dedup-key <unique_key> \
-  --metadata '{"key": "value"}'
-```
-
-**Required:**
-- `--kind` -- finding category. Use descriptive, specific kinds: `xss`, `idor`, `ssrf`, `open-redirect`, `postmessage-sink`, `gadget`, `secret-exposure`, `missing-origin-check`, `dom-clobbering`, etc.
-- `--severity` -- one of `low`, `medium`, `high`, `critical`
-
-**Optional:**
-- `--description` -- concise explanation of what was found, where, and why it matters
-- `--dedup-key` -- prevents duplicate findings. If a finding with the same kind and dedup key already exists, the command returns a dedup message instead of creating a duplicate. Use a stable identifier (e.g. the endpoint path, the file + line, or a hash of the pattern).
-- `--metadata` -- arbitrary JSON for structured data (e.g. affected endpoints, parameter names, payload used)
-
-Returns JSON:
-```json
-{"success": true, "finding_id": 42, "message": "Finding created with ID: 42"}
-```
-
-Or if deduplicated:
-```json
-{"success": false, "finding_id": null, "message": "Finding was deduplicated (already exists)"}
-```
-
-### List findings
-
-```bash
-jxscout-pro-v2 -c get-findings [options]
-```
-
-**Options (all optional):**
-- `--severity <value>` -- filter by severity (repeatable): `low`, `medium`, `high`, `critical`
-- `--kind <value>` -- filter by finding kind (repeatable)
-- `--limit <n>` -- maximum number of findings to return
-- `--offset <n>` -- number of findings to skip (for pagination)
-
-Returns JSON with the matching findings and total count:
-```json
-{"findings": [{"id": 1, "severity": "high", "kind": "xss", "description": "...", "dedup_key": "...", "metadata": {...}, "found_at": "2026-02-28T12:00:00"}], "total": 42}
-```
-
-**Examples:**
-
-List all findings:
-```bash
-jxscout-pro-v2 -c get-findings
-```
-
-List only critical and high severity findings:
-```bash
-jxscout-pro-v2 -c get-findings --severity critical --severity high
-```
-
-List findings of a specific kind with pagination:
-```bash
-jxscout-pro-v2 -c get-findings --kind xss --limit 10 --offset 0
-```
-
-### Retrieve a finding
-
-```bash
-jxscout-pro-v2 -c get-finding --kind <kind> --dedup-key <key>
-```
-
-Returns JSON with the finding details if it exists, or `{"found": false}` if not.
-
-## Guidelines
-
-- **Be specific in descriptions**: "postMessage handler in `/static/js/widget.js:145` accepts messages from any origin and passes `event.data.url` to `window.location.href`" is useful. "Possible open redirect" is not.
-- **Use dedup keys** to keep findings clean. Good dedup keys: endpoint paths, `filename:line`, handler signatures.
-- **Severity guide**:
-  - `critical` -- direct impact with no user interaction (e.g. auth bypass, RCE)
-  - `high` -- significant impact, may need minimal interaction (e.g. stored XSS, IDOR on sensitive data)
-  - `medium` -- real impact but with limitations (e.g. reflected XSS needing specific conditions, CSRF on state-changing actions)
-  - `low` -- interesting but limited impact (e.g. information disclosure, useful gadget for chaining)
-- **Metadata** is useful for machine-readable details: `{"endpoint": "/api/users", "parameter": "callback", "payload": "javascript:alert(1)"}`.
-- **Reference HTTP evidence**: if `http_requests/` exists in the project, you can reference captured request/response files in metadata (e.g. `{"evidence_request": "http_requests/target.com/api/users/GET/20260208_155236_200.req"}`) to tie findings to real traffic.
diff --git a/capabilities/web-security/skills/jxscout-relationships/SKILL.md b/capabilities/web-security/skills/jxscout-relationships/SKILL.md
deleted file mode 100644
index c58f33b..0000000
--- a/capabilities/web-security/skills/jxscout-relationships/SKILL.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-name: jxscout-relationships
-description: Query jxscout for asset relationships -- which JS files and iframes a page loads, lazy-loaded chunks, reversed source maps, and how assets relate to each other. Use when mapping the attack surface of a specific page or understanding how assets are connected.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-# jxscout Asset Relationships
-
-jxscout tracks how web assets relate to each other: which JS files an HTML page loads, which iframes it embeds, which chunks were discovered from a script, and which source maps were reversed. Use these commands to map the attack surface of a specific page or trace how assets are connected.
-
-## Prerequisites
-
-The `JXSCOUT_PROJECT_NAME` environment variable must be set. All commands use `jxscout-pro-v2 -c` (client mode).
-
-## Commands
-
-### Get JS files loaded by a page
-
-```bash
-jxscout-pro-v2 -c get-loaded-js-files <url_or_path> [--include-reversed-sources] [--json]
-```
-
-Lists all JS files loaded by an HTML page. Pass either the URL or the local file path.
-
-- `--include-reversed-sources` -- also include file paths of reversed source map files
-- `--json` -- structured output with `js_files` and optionally `reversed_sources` arrays
-
-This is useful for scoping your analysis to the JS that actually runs on a specific page, rather than searching the entire project.
-
-### Get loader page for a JS file
-
-```bash
-jxscout-pro-v2 -c get-js-file-loader-page <url_or_path> [--json]
-```
-
-Returns the HTML page(s) that load a given JS file. This is the reverse of `get-loaded-js-files`. Pass either the URL or the local file path of the JS file.
-
-Also works with reversed source files -- it follows the chain (reversed source -> source map -> JS file) to find the pages that load the original JS file the reversed source was extracted from.
-
-- `--json` -- structured output with a `loader_pages` array
-
-This is useful for impact assessment: given a JS file with a vulnerability or interesting code, find which pages are affected.
-
-### Get iframes loaded by a page
-
-```bash
-jxscout-pro-v2 -c get-loaded-iframes <url_or_path> [--json]
-```
-
-Lists all iframes embedded by an HTML page. Relevant for:
-- **postMessage analysis**: iframes are common postMessage targets and sources
-- **Cross-origin interactions**: understanding which origins are framed
-- **Clickjacking assessment**: identifying framed content
-
-## Workflow
-
-1. **Scope to a page**: `get-loaded-js-files` to see what JS runs on it — focus review on these files rather than the entire project
-2. **Check iframes**: `get-loaded-iframes` to identify cross-origin messaging patterns (postMessage targets, clickjacking candidates)
-3. **Follow the chain**: reversed sources often have more readable code — check for admin panels, feature flags, debug endpoints in lazy-loaded chunks
-4. **Assess impact**: given a vulnerable JS file, `get-js-file-loader-page` reveals which pages are affected
-
-**Checkpoint:** After mapping a page's assets, verify the relationships match what you see in the browser's Network tab. If scripts are missing, check for lazy-loaded chunks by searching for dynamic `import()` calls in the loaded JS: `rg "import\(" <js_file_path>`. If chunks are found, trace their loader page to complete the map.
diff --git a/capabilities/web-security/skills/jxscout-repeater/SKILL.md b/capabilities/web-security/skills/jxscout-repeater/SKILL.md
deleted file mode 100644
index dcc21af..0000000
--- a/capabilities/web-security/skills/jxscout-repeater/SKILL.md
+++ /dev/null
@@ -1,139 +0,0 @@
----
-name: jxscout-repeater
-description: Send and iterate on raw HTTP requests using jxscout's repeater. Use when the user asks to analyze, test, try out, send, resend, or replay an HTTP request; when testing an endpoint or API call for security issues; when modifying parameters/headers/body to test for vulnerabilities; or when the user mentions repeater, .req/.res, or raw HTTP testing.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-# jxscout Repeater
-
-The repeater sends raw HTTP requests from `.req` files and saves timestamped request/response pairs for each attempt. It's your tool for hands-on testing: modify a request, send it, check the response, iterate.
-
-## Command
-
-```bash
-jxscout-pro-v2 -c repeater <req_file> [options]
-```
-
-**Required:**
-- `<req_file>` -- path to a file containing a raw HTTP request
-
-**Options:**
-- `--url <url>` -- override connection target (e.g. `https://host:443`). When set, overrides host/port/TLS derived from the request file.
-- `--proxy-host <host>` -- send through a proxy (use with `--proxy-port`)
-- `--proxy-port <port>` -- proxy port
-
-## Request file format
-
-Plain HTTP -- the exact bytes to send. Method, path, headers, blank line, optional body:
-
-```
-POST /api/v2/users HTTP/1.1
-Host: target.com
-Authorization: Bearer eyJhbG...
-Content-Type: application/json
-
-{"user_id": 123, "role": "admin"}
-```
-
-**Content-Length** is updated automatically from the actual body before sending -- do not manually adjust it when editing the body.
-
-## Output
-
-- **stdout**: the raw HTTP response (status line, headers, body). Compressed responses are automatically decompressed.
-- **Files**: for each send, two files are created next to the input file:
-  - `<basename>_<YYYYMMDDHHMMSS>_<status>.req` -- the request that was sent
-  - `<basename>_<YYYYMMDDHHMMSS>_<status>.res` -- the response received
-
-Example: sending `repeater/idor_test/original.req` that gets a 200 creates `original_20260208155236_200.req` and `original_20260208155236_200.res`.
-
-## Workflow
-
-### Setting up
-
-If the `.req` file is **not** already in the `repeater/` folder:
-
-1. Create a directory structure under `repeater/` that identifies both the **endpoint** and the **specific test**. Use the endpoint as the top-level folder and a subfolder for each test scenario. The folder names should make it obvious what's being tested at a glance.
-   - Good: `repeater/api_v2_users_profile/idor_other_user/`, `repeater/graphql_updateRole_mutation/privilege_escalation/`, `repeater/checkout_apply_coupon/negative_amount/`, `repeater/POST_auth_login/bruteforce_lockout/`
-   - Also fine for a single test: `repeater/api_v2_users_profile/` (no subfolder needed when there's only one test for the endpoint)
-   - Bad: `repeater/idor_testing/`, `repeater/xss_test/` (too generic -- says what you're testing for but not which endpoint)
-2. Copy the `.req` file there as `original.req`
-3. Use `repeater/<endpoint>/<test>/original.req` for all subsequent work
-
-### Iterating
-
-1. Run: `jxscout-pro-v2 -c repeater repeater/<test_name>/original.req`
-2. Check stdout and/or the `.res` file for status, headers, and body
-3. Edit `original.req` -- change the parameter, header, or body you're testing
-4. Run the same command again
-5. Compare with previous responses (the timestamped `.res` files are your history)
-6. Repeat until you've confirmed or ruled out the issue
-
-Always edit the **same** `original.req` file. Each send creates a timestamped copy, so your full history of attempts is preserved automatically.
-
-### Comparing responses
-
-- Check status codes across attempts (e.g. 200 vs 403 vs 500)
-- Diff response bodies to spot behavioral changes
-- Look for error messages, stack traces, or debug output that leak information
-- Compare response sizes -- significant size differences often indicate different behavior
-
-## Practical examples
-
-### Testing for IDOR
-Edit the user ID in the request body or URL path. Send with your session token to access another user's data:
-- Original: `{"user_id": 123}` (your ID)
-- Modified: `{"user_id": 456}` (victim ID)
-- Compare: does the response return different user's data?
-
-### Testing for auth bypass
-Remove or modify the auth header:
-- Remove `Authorization` header entirely
-- Replace token with expired/invalid value
-- Try a different user's token
-- Compare: does the endpoint still return data?
-
-### Testing for injection
-Modify parameter values with payloads:
-- Add SQL metacharacters: `' OR 1=1--`
-- Add template injection: `{{7*7}}`
-- Add path traversal: `../../etc/passwd`
-- Check: error messages, different response codes, unexpected output
-
-### Testing header-based behavior
-Modify or add headers to test server behavior:
-- Add `X-Forwarded-For: 127.0.0.1` for IP-based access control bypass
-- Change `Origin` header for CORS testing
-- Modify `Content-Type` to test parser confusion
-
-## Using captured HTTP requests
-
-If `http_requests/` exists in the project working directory, jxscout has captured real HTTP traffic from the target. These `.req` files are ready-made starting points for the repeater:
-
-1. Browse `http_requests/` to find an interesting request (e.g. an API call, auth endpoint, file upload)
-2. Copy it to `repeater/<test_name>/original.req`
-3. Start iterating from a real request instead of crafting one from scratch
-
-This is especially useful when you find an interesting endpoint through static analysis and want to test it with actual headers, cookies, and auth tokens from a real session.
-
-## Important
-
-- Never create new request files for iterations -- always edit `original.req` so history accumulates in the timestamped pairs.
-- The repeater handles TLS automatically based on the scheme in the request or `--url`.
-- Use `--proxy-host` and `--proxy-port` to route through Burp or Caido for additional inspection.
-
-## Troubleshooting slow or hanging requests
-
-If a repeater request takes too long to respond or appears to hang, the `.req` file likely has formatting issues. Re-read the file carefully and check for:
-
-1. **Extra spaces in the request line** -- there must be exactly one space between the method, path, and HTTP version (e.g. `GET /path HTTP/1.1`, not `GET  /path  HTTP/1.1`)
-2. **Trailing whitespace on header lines** -- spaces or tabs after header values can cause parsing issues on the server side
-3. **Extra blank lines between headers** -- there must be zero blank lines between headers; only one blank line separating headers from the body
-4. **Spaces before or after header names/values** -- `Authorization: Bearer token` is correct, ` Authorization : Bearer token ` is not
-5. **Extra newlines or whitespace after the body** -- trailing blank lines at the end of the file can be interpreted as part of the body
-6. **Host header mismatch** -- verify the `Host` header matches the actual target server
-
-When a request hangs, fix any formatting issues found and retry before investigating other causes.
diff --git a/capabilities/web-security/skills/jxscout-security-research/SKILL.md b/capabilities/web-security/skills/jxscout-security-research/SKILL.md
deleted file mode 100644
index c1eb5a5..0000000
--- a/capabilities/web-security/skills/jxscout-security-research/SKILL.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-name: jxscout-security-research
-description: Coordinates end-to-end jxscout vulnerability assessment workflows including target enumeration, static analysis triage, and finding documentation -- routes to specific jxscout-* skills for each phase. Use when starting a new target assessment, planning attack surface mapping, performing security testing, finding vulnerabilities, or understanding how jxscout tools fit together.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-jxscout is a JS security analysis proxy -- intercepts traffic, ingests JS/HTML, runs static analyzers, reverses source maps, and maps client-side attack surface.
-
-Prerequisites: `JXSCOUT_PROJECT_NAME` env var must be set (from project `.env`). All CLI commands use `jxscout-pro-v2 -c` (client mode).
-
-## Routing Table
-
-| Need | Skill | Key command |
-|---|---|---|
-| Query static analysis matches | `jxscout-static-analysis` | `jxscout-pro-v2 -c get-matches --match-kind <type>` |
-| Document a finding | `jxscout-findings` | `jxscout-pro-v2 -c create-finding` |
-| Bookmark interesting code | `jxscout-bookmarks` | `jxscout-pro-v2 -c bookmark create` |
-| Send/replay HTTP requests | `jxscout-repeater` | `jxscout-pro-v2 -c repeater <path>` |
-| Create custom analyzers | `jxscout-custom-analyzers` | edit `settings.jsonc` analyzer section |
-| Map asset relationships | `jxscout-relationships` | `jxscout-pro-v2 -c get-loaded-js-files <url>` |
-| Setup, settings, hooks | `jxscout-setup` | `jxscout-pro-v2 -c print-full-project-settings` |
-
-## Research Workflow
-
-### 1. Orient
-```bash
-# Understand what traffic was captured
-ls http_requests/
-# Check project settings
-jxscout-pro-v2 -c print-full-project-settings
-```
-
-### 2. Enumerate attack surface
-```bash
-# List all match kinds available
-jxscout-pro-v2 -c list-match-kinds --json
-
-# Get high-value matches
-jxscout-pro-v2 -c get-matches --match-kind secret --json --show-only-unseen
-jxscout-pro-v2 -c get-matches --match-kind onmessage --json --show-only-unseen
-jxscout-pro-v2 -c get-matches --match-kind path --json --show-only-unseen
-```
-
-**Checkpoint:** Record total unseen match counts per kind. Prioritize: secrets > sinks > onmessage > paths.
-
-### 3. Triage matches
-For each match: read surrounding code, trace data flow, assess exploitability.
-- Sink with attacker-controlled input -> potential vulnerability, bookmark and investigate
-- Interesting pattern but no clear exploit -> bookmark as gadget for later chaining
-- False positive -> mark as seen: `jxscout-pro-v2 -c mark-matches-seen --match-ids 1,2,3`
-
-### 4. Deep-dive interesting files
-```bash
-# What JS runs on a specific page?
-jxscout-pro-v2 -c get-loaded-js-files https://target.com/app --json
-
-# Which pages load a vulnerable script?
-jxscout-pro-v2 -c get-js-file-loader-page /path/to/vulnerable.js --json
-```
-
-### 5. Test and validate
-Use `jxscout-repeater` to replay/modify requests. Confirm findings with working PoCs.
-
-### 6. Document
-Log confirmed findings via `jxscout-findings`. Bookmark key code patterns via `jxscout-bookmarks`.
-
-### 7. Automate patterns
-If you spot a recurring pattern, create a custom analyzer via `jxscout-custom-analyzers`. Then retrigger: `jxscout-pro-v2 -c retrigger-events --subscriber analyzer`
-
-**Checkpoint:** After each investigation round, verify all reviewed matches are marked seen (`--show-only-unseen` should return only new/unreviewed items).
diff --git a/capabilities/web-security/skills/jxscout-static-analysis/SKILL.md b/capabilities/web-security/skills/jxscout-static-analysis/SKILL.md
deleted file mode 100644
index 6e620cc..0000000
--- a/capabilities/web-security/skills/jxscout-static-analysis/SKILL.md
+++ /dev/null
@@ -1,121 +0,0 @@
----
-name: jxscout-static-analysis
-description: Query and manage jxscout static analysis matches -- list match kinds, get matches with filters, mark matches as seen/unseen. Use when triaging security findings, investigating code patterns, exploring the attack surface, reviewing scan results, or tracking vulnerability triage progress across match results.
-license: proprietary
-metadata:
-  source: jxscout-pro-v2
-  author: francisconeves97
-  origin: ported from jxscout-pro-v2 agent skills
----
-
-# jxscout Static Analysis (Matches)
-
-jxscout runs static analyzers on every ingested JS and HTML file. Results are **matches** -- structured data pointing to patterns (paths, URLs, secrets, sinks). Query them during investigation alongside direct code search for patterns analyzers don't cover.
-
-## Prerequisites
-
-The `JXSCOUT_PROJECT_NAME` environment variable must be set. It is available in the project's `.env` file at the root of the working directory. All commands use `jxscout-pro-v2 -c` (client mode).
-
-## Commands
-
-### List available match kinds
-
-```bash
-jxscout-pro-v2 -c list-match-kinds --json
-```
-
-Returns a JSON array of all enabled match kind strings for the project. Run this to know what's available -- the list depends on the project's analyzer configuration and may include custom match kinds.
-
-Common built-in match kinds: `path`, `api_path`, `hostname`, `url`, `secret`, `onmessage`, `html_manipulation`, `npm_package`, `url_search_params`, `location_assignment`.
-
-### Get matches
-
-```bash
-jxscout-pro-v2 -c get-matches --match-kind <kind> [options]
-```
-
-**Required:**
-- `--match-kind <kind>` -- the match kind to query (from `list-match-kinds`)
-
-**Options:**
-- `--json` -- output as JSON array with file paths, positions, values, and seen status (strongly recommended)
-- `--limit <n>` -- max number of matches to return (JSON mode only)
-- `--offset <n>` -- skip first n matches (JSON mode only)
-- `--file-path-include <pattern>` -- only include matches from files matching this pattern (repeatable)
-- `--file-type <type>` -- filter by file type: `js`, `html` (repeatable)
-- `--value-include <substring>` -- only include matches whose value contains this substring (repeatable)
-- `--show-only-unseen` -- only return matches that have not been marked as seen
-- `--show-only-seen` -- only return matches that have been marked as seen
-
-Without `--json`, the command outputs deduplicated match values (one per line). With `--json`, each match includes:
-
-```json
-{
-  "id": 42,
-  "match_kind": "path",
-  "match_value": "/api/v2/users",
-  "position": { "start": { "line": 42, "column": 10 }, "end": { "line": 42, "column": 26 } },
-  "file_type": "js",
-  "file_path": "/path/to/file.js",
-  "seen": false
-}
-```
-
-### Mark matches as seen
-
-```bash
-jxscout-pro-v2 -c mark-matches-seen --match-ids 1,2,3
-```
-
-Mark specific matches by ID. Use this after reviewing matches to track progress.
-
-**Bulk mode** -- mark all matches of a kind (with optional filters):
-
-```bash
-jxscout-pro-v2 -c mark-matches-seen --match-kind path
-jxscout-pro-v2 -c mark-matches-seen --match-kind path --value-include "admin"
-jxscout-pro-v2 -c mark-matches-seen --match-kind path --file-path-include "auth"
-```
-
-Bulk mode supports the same filters as `get-matches`: `--file-path-include`, `--file-type`, `--value-include`.
-
-Returns JSON: `{"updated_count": N}`
-
-### Mark matches as unseen
-
-```bash
-jxscout-pro-v2 -c mark-matches-unseen --match-ids 4,5,6
-```
-
-Same interface as `mark-matches-seen`. Use this to re-mark matches for review.
-
-**Bulk mode:**
-
-```bash
-jxscout-pro-v2 -c mark-matches-unseen --match-kind path
-```
-
-Returns JSON: `{"updated_count": N}`
-
-## Workflow
-
-1. **Discover match kinds**: `jxscout-pro-v2 -c list-match-kinds --json`
-2. **Query high-value kinds first**: `secret`, `onmessage`, `html_manipulation`, then `path`, `api_path`
-3. **Use filters** to focus:
-   - `--value-include "admin"` for admin-related paths
-   - `--value-include "internal"` for internal endpoints
-   - `--file-path-include "auth"` to scope to auth files
-   - `--show-only-unseen` for unreviewed matches only
-4. **Read the code** at match positions to understand context
-5. **Mark as seen** after reviewing: `mark-matches-seen --match-ids <ids>`
-6. **Grep for more**: matches only cover configured analyzers -- search directly for uncovered patterns
-
-**Checkpoint:** After each triage session, verify all reviewed matches are marked seen. Use `get-matches --match-kind <kind> --show-only-unseen` to confirm only new/unreviewed items remain.
-
-## HTTP request context
-
-If `http_requests/` exists in the project directory, jxscout captured raw HTTP traffic organized as `http_requests/{host}/{path}/{METHOD}/{timestamp}_{status}.req|.res`. Cross-reference `path`/`api_path` matches against captured requests to see real parameters and auth tokens, and to validate that static patterns are exercised in real traffic.
-
-## Limitations
-
-Matches only cover configured analyzers — dynamically constructed URLs, logic bugs, and uncovered patterns require direct code search. Always complement match queries with `rg` for the full picture.
diff --git a/capabilities/web-security/skills/kiterunner/SKILL.md b/capabilities/web-security/skills/kiterunner/SKILL.md
index 452cba8..36d763a 100644
--- a/capabilities/web-security/skills/kiterunner/SKILL.md
+++ b/capabilities/web-security/skills/kiterunner/SKILL.md
@@ -66,6 +66,5 @@ kr brute https://target.com -A=aspx-260227:10000 -x 5
 
 ## Chain With
 
-- **jxscout** -- extract Swagger/OpenAPI specs from source maps, convert to .kite
 - **Caido** -- replay findings via `kb replay --proxy` for evidence capture
 - **vulnx** -- discovered endpoints reveal technology versions for CVE lookup
diff --git a/capabilities/web-security/tests/test_install_tools_offline.py b/capabilities/web-security/tests/test_install_tools_offline.py
index 64a856e..8cf059c 100644
--- a/capabilities/web-security/tests/test_install_tools_offline.py
+++ b/capabilities/web-security/tests/test_install_tools_offline.py
@@ -36,11 +36,7 @@ def test_no_unpinned_go_installs(self) -> None:
         # run, so it reaches the network even when the binary is already
         # present — and produces a different tool set on different days, which
         # no SBOM can describe.
-        unpinned = [
-            line.strip()
-            for line in LINES
-            if "@latest" in line and not line.strip().startswith("#")
-        ]
+        unpinned = [line.strip() for line in LINES if "@latest" in line and not line.strip().startswith("#")]
         assert not unpinned, f"unpinned installs: {unpinned}"
 
 
@@ -57,9 +53,7 @@ def test_every_go_install_is_guarded(self) -> None:
     def test_global_npm_install_is_guarded(self) -> None:
         for i, line in enumerate(LINES):
             if re.search(r"^\s*(as_root\s+)?npm install -g", line):
-                assert "have " in _preceding_context(
-                    i
-                ), f"unguarded global npm install at line {i + 1}: {line.strip()}"
+                assert "have " in _preceding_context(i), f"unguarded global npm install at line {i + 1}: {line.strip()}"
 
     def test_npm_installs_are_version_pinned(self) -> None:
         # Same SBOM argument as the go pins: an unpinned `npm install -g`
@@ -84,11 +78,7 @@ def test_py_install_calls_are_guarded(self) -> None:
                 continue
             # Skip the py_install function definition and requirement file
             # installs (guarded by their parent clone check).
-            if (
-                stripped.startswith(("if", "elif", "def", "#"))
-                or "-r " in stripped
-                or "py_install()" in stripped
-            ):
+            if stripped.startswith(("if", "elif", "def", "#")) or "-r " in stripped or "py_install()" in stripped:
                 continue
             if "have " not in _preceding_context(i):
                 unguarded.append(stripped)
@@ -101,21 +91,15 @@ def test_pdtm_only_installs_missing_tools(self) -> None:
         assert "-install nuclei,httpx" not in INSTALL_SCRIPT
 
     def test_katana_download_is_guarded(self) -> None:
-        idx = next(
-            i for i, line in enumerate(LINES) if "katana_${KATANA_VERSION}" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "katana_${KATANA_VERSION}" in line)
         assert "have katana" in _preceding_context(idx, span=8)
 
     def test_caido_cli_download_is_guarded(self) -> None:
-        idx = next(
-            i for i, line in enumerate(LINES) if "caido.download/releases" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "caido.download/releases" in line)
         assert "command -v caido-cli" in _preceding_context(idx, span=10)
 
     def test_caido_mcp_server_download_is_guarded(self) -> None:
-        idx = next(
-            i for i, line in enumerate(LINES) if "caido-mcp-server-linux" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "caido-mcp-server-linux" in line)
         assert "command -v caido-mcp-server" in _preceding_context(idx, span=15)
 
     def test_kiterunner_build_is_guarded(self) -> None:
@@ -126,13 +110,9 @@ def test_wrangler_install_is_guarded_and_pinned(self) -> None:
         # wrangler is fetched from npm, so the guard-and-pin discipline applies
         # exactly as it does to the go installs: present binary -> no registry
         # request; absent binary -> the pinned version, not @latest.
-        idx = next(
-            i for i, line in enumerate(LINES) if "wrangler@${WRANGLER_VERSION}" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "wrangler@${WRANGLER_VERSION}" in line)
         assert "have wrangler" in _preceding_context(idx, span=6)
-        pin = next(
-            i for i, line in enumerate(LINES) if line.startswith("WRANGLER_VERSION=")
-        )
+        pin = next(i for i, line in enumerate(LINES) if line.startswith("WRANGLER_VERSION="))
         assert re.fullmatch(
             r"WRANGLER_VERSION=\"[0-9]+\.[0-9]+\.[0-9]+\"",
             LINES[pin].strip(),
@@ -168,34 +148,17 @@ class TestRootEscalation:
 
     def test_caido_cli_tar_uses_as_root(self) -> None:
         idx = next(
-            i
-            for i, line in enumerate(LINES)
-            if "tar" in line and "caido-cli" in line and "/usr/local/bin" in line
+            i for i, line in enumerate(LINES) if "tar" in line and "caido-cli" in line and "/usr/local/bin" in line
         )
         assert "as_root" in LINES[idx]
 
     def test_caido_mcp_server_install_uses_as_root(self) -> None:
-        idx = next(
-            i
-            for i, line in enumerate(LINES)
-            if "install -m" in line and "caido-mcp-server" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "install -m" in line and "caido-mcp-server" in line)
         assert "as_root" in LINES[idx]
 
     def test_kiterunner_mv_uses_as_root(self) -> None:
         idx = next(
-            i
-            for i, line in enumerate(LINES)
-            if "/usr/local/bin/kr" in line and ("mv " in line or "install " in line)
-        )
-        assert "as_root" in LINES[idx]
-
-    def test_jxscout_install_uses_as_root(self) -> None:
-        idx = next(
-            i
-            for i, line in enumerate(LINES)
-            if "/usr/local/bin/jxscout" in line
-            and ("install " in line or "curl " not in line)
+            i for i, line in enumerate(LINES) if "/usr/local/bin/kr" in line and ("mv " in line or "install " in line)
         )
         assert "as_root" in LINES[idx]
 
@@ -204,17 +167,11 @@ def test_burp_suite_uses_as_root(self) -> None:
         assert "as_root" in LINES[idx]
 
     def test_exiftool_apt_uses_as_root(self) -> None:
-        idx = next(
-            i
-            for i, line in enumerate(LINES)
-            if "apt-get" in line and "exiftool" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "apt-get" in line and "exiftool" in line)
         assert "as_root" in LINES[idx]
 
     def test_nodejs_apt_uses_as_root(self) -> None:
-        idx = next(
-            i for i, line in enumerate(LINES) if "apt-get" in line and "nodejs" in line
-        )
+        idx = next(i for i, line in enumerate(LINES) if "apt-get" in line and "nodejs" in line)
         assert "as_root" in LINES[idx]