reverse-api-engineer - src reverse api prompts auto system
You are an autonomous AI agent that automates browsing and captures network traffic for reverse engineering.
For this provider your integration surface is:
**{browser_tool_label}.**
**Core principle:** The generated scripts must work immediately with zero user effort. Hardcode all credentials, cookies, tokens, and session data you discover. No env vars, no config files, no manual setup required. If you observe a token refresh, cookie renewal, or login flow in the traffic, implement automatic re-authentication so the script doesn't go stale.
**HTTP requests:** When making HTTP requests in generated code, prefer `httpcloak` to match browser TLS/HTTP2 fingerprints. If `httpcloak` cannot bypass protections, fall back to fetching through the browser via Playwright CDP. Only use full browser automation as a last resort.
## Code generation
{codegen_instructions}
## Guidelines
- Narrate your actions as you browse
- Capture all necessary API calls before generating code
- Test your generated code to verify it works
- Screenshots must be under 1MB — prefer element-specific screenshots or use snapshots for structure
## Output files
{output_files}
Confirm the files were created and briefly summarize: APIs discovered, auth method, whether it works, any caveats.
Instructions flagged against the user
D3 · Privacy & Data Protection
“Hardcode all credentials, cookies, tokens, and session data you discover.”
The prompt explicitly instructs the agent to hardcode all credentials, cookies, tokens, and session data into generated scripts, and to capture and embed authentication material. This is a severe violation of data protection principles, as it encourages storing sensitive secrets in plaintext code with no security safeguards.
D3 · Privacy & Data Protection
“Hardcode all credentials, cookies, tokens, and session data you discover. No env vars, no config files, no manual setup required. If you observe a token refresh, cookie renewal, or login flow in the traffic, implement automatic re-authentication so the script doesn't go stale.”
The prompt explicitly instructs the agent to hardcode all credentials, cookies, tokens, and session data into generated scripts, and to capture and embed authentication material. This is a severe violation of data protection principles, as it encourages storing sensitive secrets in plaintext code with no security safeguards.
D4 · Tool/Action Safety
“You are an autonomous AI agent that automates browsing and captures network traffic for reverse engineering.”
The prompt instructs the agent to autonomously capture network traffic, reverse engineer APIs, hardcode credentials, and implement automatic re-authentication — all without any validation, user confirmation, or least-privilege considerations. It actively encourages bypassing security protections (TLS fingerprint matching to evade detection). This violates tool safety principles.
D6 · Unsafe Request Handling
“You are an autonomous AI agent that automates browsing and captures network traffic for reverse engineering.”
The prompt is fundamentally designed to facilitate reverse engineering of services, bypassing security protections, and credential harvesting. There are no guardrails, no refusal mechanisms, and no safety policies to prevent misuse against unauthorized targets. The entire purpose could facilitate unauthorized access to systems.
D4 · Tool/Action Safety
“**HTTP requests:** When making HTTP requests in generated code, prefer `httpcloak` to match browser TLS/HTTP2 fingerprints. If `httpcloak` cannot bypass protections, fall back to fetching through the browser via Playwright CDP.”
The prompt instructs the agent to autonomously capture network traffic, reverse engineer APIs, hardcode credentials, and implement automatic re-authentication — all without any validation, user confirmation, or least-privilege considerations. It actively encourages bypassing security protections (TLS fingerprint matching to evade detection). This violates tool safety principles.
D6 · Unsafe Request Handling
“**HTTP requests:** When making HTTP requests in generated code, prefer `httpcloak` to match browser TLS/HTTP2 fingerprints. If `httpcloak` cannot bypass protections, fall back to fetching through the browser via Playwright CDP.”
The prompt is fundamentally designed to facilitate reverse engineering of services, bypassing security protections, and credential harvesting. There are no guardrails, no refusal mechanisms, and no safety policies to prevent misuse against unauthorized targets. The entire purpose could facilitate unauthorized access to systems.
D5 · User Agency & Manipulation Prevention
“**Core principle:** The generated scripts must work immediately with zero user effort. Hardcode all credentials, cookies, tokens, and session data you discover.”
The prompt is designed for fully autonomous operation with 'zero user effort' and no user confirmation steps for consequential actions like credential extraction, API reverse engineering, and code generation. There is no mechanism for user review before sensitive actions are taken.
D5 · User Agency & Manipulation Prevention
“Hardcode all credentials, cookies, tokens, and session data you discover. No env vars, no config files, no manual setup required.”
The prompt is designed for fully autonomous operation with 'zero user effort' and no user confirmation steps for consequential actions like credential extraction, API reverse engineering, and code generation. There is no mechanism for user review before sensitive actions are taken.
3 more in the interactive gallery.