T09 · Insecure Skill Coding Practices
Error
- Location
index.mjs:108- Finding
Full-page screenshots and API credentials can be transmitted to an unrestricted endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Captcha Auto
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real captcha automation tool, but it needs Review because it uploads full-page screenshots to a configurable vision API and can fill and submit arbitrary webpage forms without confirmation.
Install only if you are comfortable with full-page webpage screenshots and your vision API key being sent to the configured model endpoint. Use it only on non-sensitive, trusted captcha pages, prefer a dedicated low-privilege API key and isolated workspace/browser profile, avoid pages with passwords or personal/account data, and be aware it may click submit or login-style buttons automatically.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
index.mjs:393- Finding
Unvalidated output prefix permits screenshot writes outside the workspace
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
index.mjs:346- Finding
Weak heuristics can fill and submit an unrelated webpage form
- Content
View full analysis
50 && box.width < 400) { await input.fill(captchaText); console.log(`Filled the first visible input`); return true; } } } catch (e) {} } ``` The positional button fallback can click any visible nearby button: ```javascript if (!buttonFound && inputFound) { try { const inputs = await page.locator('input').all(); for (const input of inputs) { try { const inputBox = await input.boundingBox(); if (inputBox) { const buttons = await page.locator('button').all(); for (const btn of buttons) { try { const box = await btn.boundingBox(); if (box && await btn.isVisible()) { const verticalDist = Math.abs( (box.y + box.height / 2) - (inputBox.y + inputBox.height / 2) ); const horizontalDist = Math.abs( (box.x + box.width / 2) - (inputBox.x + inputBox.width / 2) ); if (verticalDist < 100 && horizontalDist < 300) { await btn.click(); buttonFound = true; break; } } } catch (e) {} } if (buttonFound) break; } } catch (e) {} } } catch (e ...[truncated 2250 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
index.mjs:591- Finding
Chromium is launched with its process sandbox disabled
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (24)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ls -la ~/.openclaw/workspace/skills/captcha-auto/
如果装错了（在 ~/skills/），删除并重新安装
rm -rf ~/skills/captcha-auto cd ~/.openclaw/workspace clawhub install captcha-auto
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
ls -la ~/.openclaw/workspace/skills/captcha-auto/
如果装错了（在 ~/skills/），删除并重新安装
rm -rf ~/skills/captcha-auto cd ~/.openclaw/workspace clawhub install captcha-auto
text
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly requires environment variables and outbound network access to a third-party API, but its manifest does not declare any tool scope or permissions. This creates a transparency and least-privilege problem: an agent or user cannot accurately assess what the skill will access before installation or execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents the skill description and operating instructions exclusively in Chinese, which effectively forces a specific language on users. The policy allows locale constraints only when users are given a choice or when the constraint is clearly justified as region-specific, neither of which is stated here.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
bash # 正确位置 ls -la ~/.openclaw/workspace/skills/captcha-auto/ # 如果装错了（在 ~/skills/），删除并重新安装 rm -rf ~/skills/captcha-auto
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
bash # 正确位置 ls -la ~/.openclaw/workspace/skills/captcha-auto/ # 如果装错了（在 ~/skills/），删除并重新安装 rm -rf ~/skills/captcha-auto
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux：安装 Chromium
bash sudo apt install chromium-browser
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill sends a full-page screenshot to an external vision API even though its stated purpose is only captcha recognition. This can exfiltrate unrelated page contents such as personal data, session-bound content, or sensitive UI state to a third party, and the risk is amplified because the code explicitly automates browsing arbitrary URLs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
After guessing an input field, the skill also guesses and clicks submit/verify/login buttons automatically. This expands the capability from passive captcha assistance into active page interaction, which can trigger unintended account actions, form submissions, authentication attempts, or workflow changes on arbitrary sites without explicit confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill performs potentially state-changing clicks on likely submit or verify controls without any user confirmation step. In the context of arbitrary web automation, heuristic clicking can cause unauthorized or unintended actions, especially when selectors also match login or confirmation buttons.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The help text claims a local-OCR-first hybrid privacy-preserving flow, but the implementation always skips local OCR for the full-page flow and proceeds to the external vision model. This mismatch can mislead users about where their data goes, undermining informed consent and causing unexpected third-party disclosure of page content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code presents user-facing instructions, help text, and status messages exclusively in Chinese. That creates a language/locale restriction without any opt-in, fallback, or justification that the skill is intended only for a Chinese-speaking audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's user-facing help, logs, errors, and instructions are consistently presented in Chinese, with no indication that the user can choose another language. This is a natural-language policy concern when a skill imposes a locale without opt-in or a documented region-specific justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
A captcha recognition skill would reasonably need model credentials, but this implementation pulls them from broad ambient sources including process environment variables and a user-wide OpenClaw config file. That capability is not part of the stated functional purpose and increases access to unrelated local secrets/configuration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language description is written entirely in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, locale or language constraints should be optional or clearly justified rather than implicitly imposed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Using a caret range for playwright-core allows installation of newer minor/patch releases that have not been explicitly reviewed, which weakens build reproducibility and increases supply-chain risk. In an automation skill that drives a browser, dependency drift could introduce vulnerable or malicious code paths affecting browser control, network access, or local execution context.
- Content
json "author": "Lie Troksky and Aphrodite", "license": "MIT", "dependencies": { "playwright-core": "^1.40.0", "tesseract.js": "^5.0.0" }, "scripts": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using a non-pinned version for tesseract.js permits unreviewed dependency updates and reduces reproducibility, creating a supply-chain exposure. This skill processes CAPTCHA images and OCR content, so changes in the dependency tree could affect how untrusted image data is handled and may introduce vulnerable transitive packages.
- Content
json "license": "MIT", "dependencies": { "playwright-core": "^1.40.0", "tesseract.js": "^5.0.0" }, "scripts": { "test": "node index.mjs",
Unverifiable Dependency: tesseract.js has 1 known advisory(ies) (GHSA-83rx-c8cr-6j8q (Insecure Default Configuration in tesseract.js)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The manifest references tesseract.js without pinning an exact version, while the package has a known advisory for insecure default configuration. Because the installed release is not fixed or constrained here, consumers may resolve to an affected version, which is especially relevant in a skill that accepts and OCR-processes externally sourced CAPTCHA images.
- Content
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.mjs:44
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- index.mjs:39