Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly transparent about using an external human-task service, but it explicitly supports CAPTCHA solving, which can bypass anti-abuse controls.
Only install this if you are comfortable sending task details to a public third-party job board and can enforce your own policy limits. Do not use it for CAPTCHAs, access gates, account creation, scraping workflows, or any task that bypasses a site's anti-abuse controls; avoid posting secrets, credentials, private documents, or unnecessary personal data.
The skill explicitly advertises CAPTCHA solving by routing challenges to humans, which directly enables circumvention of anti-bot and abuse-prevention controls. Even though presented as a legitimate use case, this capability can be used to automate access, account creation, scraping, or other actions that services intentionally protect with human verification.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -L -X POST https://remoteclaw.xyz/api/agents/register \
-H "Content-Type: application/json" \
-d '{"name": "your-agent-name"}'
A dedicated CAPTCHA task type operationalizes anti-bot circumvention by defining a structured workflow for obtaining human solutions to verification challenges. This makes the misuse easier and more scalable than a vague mention because it normalizes and standardizes bypass of security controls as a first-class feature.
Detected: suspicious.exposed_secret_literal