Captcha Relay

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:25 PM UTC
• Version: 2.1.0

Overview

This CAPTCHA relay exposes browser and token-solving workflows over the network without enough access controls, so users should review it carefully before installing.

Install only if you intentionally want a human-in-the-loop CAPTCHA tool that can interact with a Chrome session. Avoid public tunnels, do not use it on sensitive or unauthorized sites, prefer localhost or tightly controlled private access, and require per-session secrets before exposing any relay. Review the unpinned npx tunnel path, dependency versions, predictable token file, and browser relay before use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/browser-relay.js:62
• Finding: Unauthenticated Browser Relay Exposes Screen Content and Full Browser Input Control<![CDATA[ ## Vulnerability Details **File Location**: `lib/browser-relay.js:62-190` **Vulnerability Type**: Missing authentication and authorization on a network-accessible browser-control service **Risk Level**: High ### Technical Analysis The browser relay binds to all network interfaces by default and accepts every HTTP and WebSocket client without authentication, authorization, origin validation, or a session-specific access token. Relevant code: ```js async function createBrowserRelay({ cdpPort = 18800, targetId, port = 0, host = '0.0.0.0', timeout = 300000, quality = 60, maxWidth = 1280, maxHeight = 900, everyNthFrame = 1, } = {}) { ``` ```js // HTTP server const server = http.createServer((req, res) => { if (req.method === 'GET' && (req.url === '/' || req.url === '/index.html')) { res.writeHead(200, { 'Content-Type': 'text/html' }); res.end(html); } else { res.writeHead(404); res.end('Not found'); } }); // WebSocket server for client interaction const wss = new WebSocket.Server({ server }); wss.on('connection', async (ws) => { clients.add(ws); console.log(`[browser-relay] client connected (${clients.size} total)`); // Restart screencast so frames flow to new clients try { await cdp.send('Page.stopScreencast').catch(() => {}); await cdp.send('Page.startScreencast', { format: 'jpeg', quality, maxWidth, maxHeight, everyNthFrame, }); console.log('[browser-relay] screencast restarted for new client'); } catch (e) { console.error('[browser-relay] screencast restart failed:', e.message); } ws.on('message', async (raw) => { try { const msg = JSON.parse(raw); await handleInput(cdp, msg, viewportWidth, viewportHeight); } catch (e) { console.error('[browser-relay] input error:', e.message); } }); ws.on('close', () => { clients.delete(ws); console.log(`[browser-relay] client disconnected (${clients.size} total)`); }); }); ``` ```js ser ...[truncated 1953 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bind to `127.0.0.1` by default and require an explicit option to expose the service. - Generate a cryptographically random, single-use session token and require it for both HTTP and WebSocket access. - Validate the WebSocket `Origin` header and reject unapproved origins. - Restrict access using Tailscale ACLs or a host firewall; do not treat Tailnet membership alone as application authorization. - Use TLS whenever traffic can leave a trusted encrypted overlay. - Limit the relay to the CAPTCHA frame or coordinates rather than exposing the complete browser tab. - Require explicit user confirmation before enabling keyboard input or sensitive navigation. - Allow only one authorized client and close the service after CAPTCHA completion. - Add connection rate limits, message-size limits, input schema validation, and security event logging. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: lib/server.js:28
• Finding: Public CAPTCHA Token Endpoint Has No Authentication or Request Limits<![CDATA[ ## Vulnerability Details **File Location**: `lib/server.js:28-46` **Vulnerability Type**: Unauthenticated sensitive-token submission, permissive CORS, and unbounded request buffering **Risk Level**: High ### Technical Analysis The relay accepts a CAPTCHA token from any caller that can reach `/token`. It does not require a session secret, validate the request origin, validate token type or length, or limit the request body size. ```js server = http.createServer((req, res) => { if (req.method === 'GET' && req.url === '/') { res.writeHead(200, { 'Content-Type': 'text/html', 'Access-Control-Allow-Origin': '*' }); res.end(html); } else if (req.method === 'POST' && req.url === '/token') { let body = ''; req.on('data', c => body += c); req.on('end', () => { try { const { token } = JSON.parse(body); res.writeHead(200, { 'Content-Type': 'application/json', 'Access-Control-Allow-Origin': '*' }); res.end(JSON.stringify({ ok: true })); // Write token to predictable file for external consumers const tokenFile = path.join(require('os').tmpdir(), 'captcha-relay-token.txt'); fs.writeFileSync(tokenFile, token); tokenResolve(token); } catch { res.writeHead(400); res.end('Bad request'); } }); ``` The server also explicitly allows cross-origin requests: ```js } else if (req.method === 'OPTIONS') { res.writeHead(200, { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, POST, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type', }); res.end(); ``` Binding occurs on every interface: ```js server.listen(0, '0.0.0.0', () => { ``` The `fetch('/token', ...)` calls in the CAPTCHA templates are functionally necessary: they send the solved provider token back to the same relay origin. They are not, by themselves, evidence of third-party exfiltration. The security problem is that the receiving endpoint is publicly ...[truncated 1621 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Generate a high-entropy, per-session nonce using `crypto.randomBytes`. - Put the nonce in the relay URL and require it in a header or POST body for `/token`. - Make the nonce single-use and invalidate it immediately after successful submission. - Remove wildcard CORS; same-origin template requests do not require it. - Validate `Content-Type`, token presence, token type, and a conservative maximum token length. - Reject requests once a token has already been accepted. - Enforce a request-body limit and destroy the connection when exceeded. - Add request deadlines and per-IP rate limiting. - Bind to loopback when a tunnel is used; let the tunnel connect locally rather than exposing the port to the entire LAN. - Prefer a private authenticated overlay and apply network ACLs in addition to application-layer authentication. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: lib/server.js:40
• Finding: Predictable Temporary Token File Enables Token Disclosure and Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `lib/server.js:40-43` **Vulnerability Type**: Unsafe predictable temporary file containing sensitive data **Risk Level**: High ### Technical Analysis Every relay session writes the token to the same predictable path in the shared temporary directory: ```js // Write token to predictable file for external consumers const tokenFile = path.join(require('os').tmpdir(), 'captcha-relay-token.txt'); fs.writeFileSync(tokenFile, token); tokenResolve(token); ``` The code does not: - Create the file atomically with exclusive creation. - Reject symbolic links. - Set a restrictive file mode explicitly. - Create a private per-user or per-session directory. - Remove the token file after it is consumed. On Unix-like systems, `fs.writeFileSync` follows an existing symbolic link. A local attacker who can prepare `/tmp/captcha-relay-token.txt` may point it at another file writable by the relay process. A subsequent token submission can then truncate and overwrite that target with attacker-controlled token text. The resulting file permissions also depend on the process umask. The token may remain readable to other local users and persists after the relay ends. ### Attack Path 1. A local attacker creates a symbolic link at `/tmp/captcha-relay-token.txt` pointing to a file writable by the account running the relay. 2. The attacker or legitimate user causes a relay token to be submitted. 3. `fs.writeFileSync` follows the symbolic link and truncates the target. 4. The target is overwritten with the supplied token string. 5. Alternatively, another local user waits for normal operation and reads the predictable file before token expiration or cleanup. ### Impact Assessment Possible impacts include: - Overwriting or corrupting arbitrary files writable by the relay process. - CAPTCHA token disclosure to local users. - Token replay during the provider's validity window. - Cross-session leakage because one fixed path is reused. ...[truncated 247 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not write the token to disk unless an explicit integration requires it; resolve the in-memory promise only. - If storage is required, create a private directory with `fs.mkdtemp` and mode `0700`. - Open a randomized file using `O_CREAT | O_EXCL | O_NOFOLLOW` where supported. - Set file permissions to `0600` explicitly. - Never reuse a global filename across sessions. - Delete the file immediately after the intended consumer reads it and also during timeout/error cleanup. - Verify with `lstat` that the destination is not a symbolic link. - Avoid logging the token or returning it through broader channels than necessary. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: lib/tunnel.js:35
• Finding: Relay Mode Executes an Unpinned Package Retrieved at Runtime Through npx<![CDATA[ ## Vulnerability Details **File Location**: `lib/tunnel.js:35-39` **Vulnerability Type**: Runtime remote package retrieval and supply-chain execution **Risk Level**: High ### Technical Analysis Relay mode starts LocalTunnel with `npx`: ```js function startLocaltunnel(localPort) { return new Promise((resolve, reject) => { const proc = spawn('npx', ['localtunnel', '--port', String(localPort)], { stdio: ['ignore', 'pipe', 'pipe'], }); ``` `localtunnel` is not declared in `package.json` and is absent from the lockfile. Depending on the installed npm/npx behavior and local cache, `npx localtunnel` can retrieve the current package from the npm registry and execute its binary at runtime. This creates a mutable execution channel: the effective code can change after this project has been audited, and no reviewed lockfile integrity value constrains the downloaded LocalTunnel package or its transitive dependencies. Relay mode uses tunneling by default, making this path part of normal token-relay operation. The call uses an argument array rather than a shell command, so the shown code does not create shell metacharacter injection through `localPort`. The primary risk is unpinned remote code execution and package supply-chain compromise. ### Attack Path 1. A user runs `node index.js --mode relay`. 2. `solveCaptcha` calls `startTunnel`, which tries LocalTunnel first. 3. The process executes `npx localtunnel`. 4. If the package is not installed or cached, npx retrieves package content from the configured npm registry. 5. A compromised package release, registry, dependency, or npm configuration supplies malicious code. 6. The downloaded package executes with the privileges and environment of the user running the Skill. 7. That code can access local files, browser debugging endpoints, environment variables, and network resources available to the process. ### Impact Assessment A compromised runtime dependency could obtain all privileges of the ...[truncated 475 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Declare `localtunnel` as an exact-version dependency and commit the resulting lockfile. - Invoke the installed binary from `node_modules/.bin` rather than allowing npx to download it at runtime. - Use `npm exec --offline --no` or equivalent controls that fail rather than fetching missing packages. - Review the pinned package and its transitive dependencies. - Use lockfile integrity checks, a trusted registry, and package provenance verification. - Consider implementing the tunnel integration through a reviewed API/library rather than executing a mutable CLI package. - Make public tunneling opt-in rather than the default. - Document the external service's confidentiality and availability implications. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: TAILSCALE.md:17
• Finding: Documentation Recommends Executing an Unverified Remote Installation Script<![CDATA[ ## Vulnerability Details **File Location**: `TAILSCALE.md:17-22` **Vulnerability Type**: Remote script execution through a `curl | sh` installation pipeline **Risk Level**: Medium ### Technical Analysis The Tailscale setup instructions recommend piping a remote script directly into a shell: ```bash # Install curl -fsSL https://tailscale.com/install.sh | sh # Start and authenticate sudo tailscale up ``` Although `tailscale.com` is the official vendor domain and HTTPS reduces network interception risk, this command executes whatever content the server returns at that moment. The script is not pinned by version or digest and cannot be reviewed before execution in the documented workflow. The instruction is optional and is not automatically invoked by the project code, which reduces exploitability. Nevertheless, it creates a remote payload execution channel and may invoke privileged installation behavior depending on the downloaded script and system configuration. ### Attack Path 1. A user follows `TAILSCALE.md` to configure relay access. 2. `curl` retrieves the current `install.sh` response from the external domain. 3. The response is immediately passed to `sh`. 4. If the vendor site, delivery infrastructure, DNS/TLS trust chain, or returned script is compromised, attacker-controlled shell commands execute. 5. Installation scripts commonly request or invoke elevated privileges, potentially increasing the impact beyond the current user. ### Impact Assessment A malicious response could execute arbitrary commands under the invoking user's privileges and potentially obtain elevated privileges if the installation flow uses `sudo`. Potential consequences include system modification, credential access, persistence, or installation of unauthorized software. No evidence in the audited project shows that the current official Tailscale script is malicious. The finding concerns the unsafe, mutable installation method. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer signed distribution packages from an explicitly configured vendor repository. - Pin the repository signing key and verify its fingerprint through an independent channel. - If a script must be used, download it to disk first, inspect it, and verify a published cryptographic checksum or signature before execution. - Pin a specific release rather than using an unversioned installation endpoint. - Explain what privileged changes the installer will perform. - Avoid combining retrieval and execution in one pipeline. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/server.js:23
• Finding: Unescaped Site Key Substitution Permits HTML and Script Injection in Relay Pages<![CDATA[ ## Vulnerability Details **File Location**: `lib/server.js:23-26` **Vulnerability Type**: Server-generated HTML injection through unescaped template values **Risk Level**: Medium ### Technical Analysis The relay server substitutes `sitekey` and `pageUrl` directly into HTML without context-aware escaping: ```js const html = template .replace(/\{\{SITEKEY\}\}/g, sitekey) .replace(/\{\{PAGE_URL\}\}/g, pageUrl || ''); ``` The CAPTCHA templates place the site key inside an HTML attribute. For example, `lib/templates/recaptcha-v2.html:21` contains: ```html <div class="g-recaptcha" data-sitekey="{{SITEKEY}}" data-callback="onSolved"></div> ``` Equivalent attribute substitution occurs in: ```html <div class="h-captcha" data-sitekey="{{SITEKEY}}" data-callback="onSolved"></div> ``` at `lib/templates/hcaptcha.html:20`, and: ```html <div class="cf-turnstile" data-sitekey="{{SITEKEY}}" data-callback="onSolved"></div> ``` at `lib/templates/turnstile.html:20`. A value containing quotation marks and additional markup can break out of `data-sitekey` and inject HTML or JavaScript into the page. The value normally originates from the automated browser's DOM through `detect.js`, and `solveCaptcha` also permits a manual `sitekey` override. Neither path validates the expected provider-specific site-key format. ### Attack Path 1. The automated browser visits a malicious or compromised page containing an attacker-controlled `data-sitekey`, or an untrusted caller supplies the manual override. 2. Detection returns that value to `solveCaptcha`. 3. `createRelayServer` substitutes the value into the HTML attribute without escaping. 4. The user opens the generated relay URL on a phone or another browser. 5. The injected markup or script executes in the relay page's origin. 6. The script can manipulate the relay UI, submit a forged token to the same-origin endpoint, or make network requests from the solver's browser. ### Impact Assessment The attacker can execute ...[truncated 488 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate site keys against strict provider-specific character sets and maximum lengths. - Escape substituted values for their exact HTML context; for attributes, encode at least `&`, `"`, `'`, `<`, and `>`. - Replace string substitution with a template engine configured for automatic escaping. - Reject unsupported CAPTCHA types and malformed page URLs before creating the server. - Add a restrictive Content Security Policy that only permits the required CAPTCHA provider script and disallows inline attacker-controlled execution. - Add `X-Content-Type-Options: nosniff`, `Referrer-Policy`, and appropriate framing restrictions. - Treat values extracted from the automated page as untrusted, even when they appear to be provider identifiers. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a clear description-to-behavior mismatch. The declared purpose is narrowly focused on CAPTCHA solving workflows, especially a screenshot-click mode and a token relay mode. The supplied code instead provides infrastructure for remote live viewing and interactive control of an entire browser tab using CDP screencasting and input dispatch. That is a broader and materially different capability than the declared CAPTCHA-specific behavior. While such a relay could potentially support human CAPTCHA solving, the code shown does not implement the described CAPTCHA logic: no grid overlay generation, no human reply parsing for CAPTCHA clicks, no CAPTCHA type/sitekey detection, no relay page hosting of real CAPTCHA widgets, and no token injection into pages. It also exposes a general HTTP/WebSocket control surface on the network, which is an undeclared capability relative to the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This code chunk does not implement the declared CAPTCHA-solving behavior. Instead, it provides general-purpose infrastructure for controlling a Chromium instance via the Chrome DevTools Protocol. While CDP could be used later for token injection, the supplied code itself only establishes generic connectivity and command transport to browser debugging targets. The declared description emphasizes two CAPTCHA-solving modes and associated user/relay workflows, none of which are present here. Because the chunk exposes broad browser-control capability and local network access not reflected in the declared permissions/purpose, this is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The chunk generally aligns with the declared token relay concept because it serves a CAPTCHA HTML template and accepts a token submission. However, it also performs undeclared behavior: persisting the solved token to a predictable file in the OS temp directory for external access. That is a materially relevant capability not mentioned in the description. Additionally, the server is exposed on 0.0.0.0 and uses wildcard CORS, which broadens access beyond a minimal local relay and is not reflected in the declared description. The screenshot mode and CDP injection are not present in this chunk, but absence of those features in an isolated file is not itself a mismatch.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install
curl -fsSL https://tailscale.com/install.sh | sh

# Start and authenticate
sudo tailscale up

• Confidence: 98% confidence
• Finding: The documentation instructs users to fetch a remote script over the network and immediately execute it with the shell. If the remote endpoint, transport path, or hosting account is compromised, arbitrary code would run on the user's machine during installation, which is especially risky in a security-sensitive toolchain.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install
curl -fsSL https://tailscale.com/install.sh | sh

# Start and authenticate
sudo tailscale up

• Confidence: 99% confidence
• Finding: The '| sh' chaining pattern removes any opportunity for the user to inspect the downloaded content before execution and turns a network fetch directly into code execution. In this skill's context, which already enables remote relay infrastructure for CAPTCHA handling, normalizing opaque one-liner execution increases the danger because operators may deploy it quickly on exposed or sensitive systems.

Known Vulnerable Dependency: sharp==0.33.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The lockfile pins sharp to 0.33.5, and the supplied advisories indicate known vulnerabilities inherited through bundled native image-processing dependencies such as libvips/libheif. In this skill, sharp is especially relevant because the feature set explicitly processes screenshots for CAPTCHA solving, so attacker-controlled images or crafted page content could trigger memory corruption, parsing flaws, or denial of service in a native library.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The lockfile includes ws 8.19.0, which the finding maps to memory disclosure and memory-exhaustion vulnerabilities. Because this skill’s token relay mode explicitly relies on network access and websocket-style communication is commonly used for browser/CDP or relay channels, a vulnerable ws dependency could expose sensitive process memory or allow a remote peer to crash or degrade the service via crafted fragmented frames.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: If the installed version resolves to ws 8.19.0, the package is exposed to reported memory disclosure and memory-exhaustion denial-of-service issues. This skill's relay mode depends on WebSocket communication, so attacker-controlled or untrusted peers could potentially trigger crashes, resource exhaustion, or unintended data exposure during CAPTCHA relay sessions.

Known Vulnerable Dependency: sharp==0.33.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: If the resolved package is sharp 0.33.5, the skill may inherit vulnerabilities from libvips/libheif used for image parsing and transformation. Because screenshot mode captures and processes images, flaws in native image libraries can increase the risk of crashes, denial of service, or potentially worse memory-safety impacts when malformed image data is handled.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Starting network tunnels and exposing a local HTTP relay without an explicit warning is dangerous because it can make a local service reachable from outside the machine. In this skill's context, that exposure is more serious because the server is tied to CAPTCHA-solving flows and token return paths, which could be abused if discovered or misconfigured.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The architecture includes starting an HTTP server, exposing it through a tunnel, and sending the URL via Telegram, which materially expands the skill's attack surface beyond simple local CAPTCHA assistance. These capabilities create external connectivity and third-party data flow paths that can expose the relay service, CAPTCHA metadata, and possibly session-linked tokens to unintended parties.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The architecture handles CAPTCHA tokens and relays them through an externally reachable workflow but does not warn users about privacy, credential-adjacent sensitivity, or local system exposure. Users may unknowingly disclose challenge-response material or leave sensitive artifacts on disk, increasing the chance of misuse or leakage.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: Invoking `npx localtunnel` without pinning a specific package version allows whatever version is current at execution time to be fetched and run. In a security-sensitive skill that exposes a relay server and handles CAPTCHA tokens, this creates supply-chain risk and can lead to execution of malicious or compromised package code.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The statement that reCAPTCHA v2 'works anyway' on other domains signals that the design is intended to relay or replay CAPTCHA challenges outside their original site context. That behavior is closely aligned with CAPTCHA bypass/abuse workflows, enabling a human solver on a different domain to generate tokens for automated browsing and undermining anti-bot protections.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence
• Finding: This second reference repeats the same unsafe pattern: relying on unpinned `npx localtunnel` means remote code is dynamically selected at runtime. Because this architecture already opens inbound access paths and relays sensitive CAPTCHA data, a compromised package or breaking update could directly undermine host and browser security.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly instructs users to send CAPTCHA screenshots to a phone or via Telegram and, in relay mode, to expose a relay URL through Tailscale, LAN, or localtunnel. Those actions can leak sensitive page contents, session-linked CAPTCHA context, or make the relay endpoint reachable beyond the intended device if users do not understand the exposure, and the documentation does not prominently warn about these privacy and access risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs users to capture browser content and send it to a human via Telegram or a relay URL, but it does not clearly warn that screenshots, challenge pages, and relay tokens may contain sensitive page content, session-linked CAPTCHA state, or other private information. That omission increases the chance of accidental data disclosure through external channels.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The documented workflow sends CAPTCHA screenshots or relay links to a human outside the local execution boundary, which can disclose visible page contents and challenge data tied to an authenticated session. In context, this skill is specifically designed to bypass or outsource CAPTCHA challenges, so the external sharing path is more dangerous than a generic support workflow because it can leak sensitive browsing context during an anti-abuse checkpoint.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The agent workflow operationalizes sending captured artifacts to a human over an external channel, creating a direct exfiltration path for browser-visible content and potentially session-bound CAPTCHA materials. Because the workflow is central to the skill's design, the context makes the issue more significant: the data sharing is not incidental, but a required step that could expose confidential information whenever used on sensitive pages.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl -fsSL https://tailscale.com/install.sh | sh

# Start and authenticate
sudo tailscale up

# Note your Tailscale IP
tailscale ip -4

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The CLI starts a browser relay server against a Chrome DevTools target and advertises both localhost and a Tailscale-accessible URL, which expands the capability from a CAPTCHA-specific helper into a more general remote browser control surface. In the context of a CAPTCHA-relay skill, that broader relay can enable unintended interaction with arbitrary page contents, session state, and authenticated browser context if exposed to other users or networks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code captures a screenshot of an active CAPTCHA challenge and writes it to disk in /tmp without any built-in notice, consent, retention control, or minimization. In the stated skill context, the screenshot is explicitly intended to be relayed to a human solver, which can expose page content, identifiers, or other sensitive data and facilitates CAPTCHA bypass through human-in-the-loop outsourcing.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This function programmatically injects clicks into a reCAPTCHA grid and triggers verification, completing the CAPTCHA based on externally supplied cell selections. In the skill context, this is not incidental automation but a core mechanism for bypassing CAPTCHA protections, enabling abuse of anti-bot controls and unauthorized account creation, scraping, or fraud workflows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: In relay mode, the skill emits CAPTCHA metadata and a reachable relay URL to stdout immediately, with no access control, recipient verification, or user confirmation in this file. In this skill context, that behavior is the core mechanism for outsourcing CAPTCHA solving, so any unintended disclosure of the URL or page metadata could let an unauthorized party access the relay page or learn details about the protected target workflow.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This file intentionally exposes a live browser tab over HTTP/WebSocket and forwards arbitrary mouse and keyboard events into the active Chrome page. Although described as CAPTCHA assistance, the implementation grants full remote control of the page contents, which can be abused to navigate, submit forms, read sensitive on-screen data, or perform arbitrary actions in the browser session far beyond CAPTCHA solving.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_resource_identifier

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib/tunnel.js:36

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: browser-relay-cli.js:24