Captcha Auto

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:16 PM UTC
• Version: 1.0.7

Overview

The skill is a real captcha automation tool, but it needs Review because it uploads full-page screenshots to a configurable vision API and can fill and submit arbitrary webpage forms without confirmation.

Install only if you are comfortable with full-page webpage screenshots and your vision API key being sent to the configured model endpoint. Use it only on non-sensitive, trusted captcha pages, prefer a dedicated low-privilege API key and isolated workspace/browser profile, avoid pages with passwords or personal/account data, and be aware it may click submit or login-style buttons automatically.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.mjs:108
• Finding: Full-page screenshots and API credentials can be transmitted to an unrestricted endpoint<![CDATA[ ## Vulnerability Details **File Location**: `index.mjs:34-69`, `index.mjs:108-130`, `index.mjs:604-630` **Vulnerability Type**: Sensitive-data exposure through an unrestricted network destination **Risk Level**: High ### Complete Code Snippet ```javascript function loadConfig(overrides = {}) { if (overrides.apiKey) { return { baseUrl: overrides.baseUrl || 'https://dashscope.aliyuncs.com/compatible-mode/v1', apiKey: overrides.apiKey, model: overrides.model || 'qwen3-vl-plus' }; } const envApiKey = process.env.VISION_API_KEY || process.env.QWEN_API_KEY; if (envApiKey) { return { baseUrl: process.env.VISION_BASE_URL || process.env.QWEN_BASE_URL || 'https://dashscope.aliyuncs.com/compatible-mode/v1', apiKey: envApiKey, model: process.env.VISION_MODEL || process.env.QWEN_MODEL || 'qwen3-vl-plus' }; } ``` ```javascript const imageBuffer = fs.readFileSync(screenshotPath); const base64Image = imageBuffer.toString('base64'); const response = await fetch(`${config.baseUrl}/chat/completions`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${config.apiKey}` }, body: JSON.stringify({ model: config.model, messages: [ { role: 'user', content: [ { type: 'text', text: `This is a webpage screenshot. Identify the text in the CAPTCHA image. Return only the CAPTCHA text, normally 4-6 alphanumeric characters, without descriptions. Return "UNRECOGNIZABLE" if the CAPTCHA is not visible or cannot be recognized.` }, { type: 'image_url', image_url: { url: `data:image/png;base64,${base64Image}` } } ] } ], max_tokens: 20, temperature: 0.1 }) }); ``` ```javascript screenshots.page = path.join(WORKSPACE_DIR, `${outputPrefix}_page.png`); await page.screenshot({ path: screenshots.page, fullPage: true }); await page. ...[truncated 2946 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Locate the CAPTCHA element locally and capture only its bounding box instead of using a full-page screenshot. 2. Default to local OCR and require explicit user confirmation before any remote vision fallback. 3. Enforce HTTPS by parsing the endpoint with `new URL()` and rejecting protocols other than `https:`. 4. Maintain an explicit allowlist of trusted API origins. 5. Refuse to send an API key when the selected origin differs from the credential's configured provider. 6. Display the exact destination origin and data scope before transmission. 7. Redact sensitive form fields and page regions before producing any image sent remotely. 8. Set request timeouts, response-size limits, and redirect restrictions. In particular, prevent redirects to untrusted origins. 9. Use provider-specific credentials with minimum quota and scope, and support rapid credential revocation. 10. Document retention and privacy properties of the selected remote provider. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: index.mjs:393
• Finding: Unvalidated output prefix permits screenshot writes outside the workspace<![CDATA[ ## Vulnerability Details **File Location**: `index.mjs:385-397`, `index.mjs:604-610`, `index.mjs:646-650`, `index.mjs:678-684` **Vulnerability Type**: Path traversal and uncontrolled file placement **Risk Level**: Medium ### Complete Code Snippet ```javascript const filledPath = path.join(WORKSPACE_DIR, `${outputPrefix}_filled.png`); await page.screenshot({ path: filledPath, fullPage: true }); ``` ```javascript screenshots.page = path.join(WORKSPACE_DIR, `${outputPrefix}_page.png`); await page.screenshot({ path: screenshots.page, fullPage: true }); ``` ```javascript screenshots.result = path.join(WORKSPACE_DIR, `${outputPrefix}_result.png`); await page.screenshot({ path: screenshots.result, fullPage: true }); ``` ```javascript screenshots.error = path.join(WORKSPACE_DIR, `${outputPrefix}_error.png`); await page.screenshot({ path: screenshots.error, fullPage: true }); ``` The value originates from caller-controlled options: ```javascript if (arg.startsWith('--prefix=')) options.outputPrefix = arg.substring(9); ``` ### Technical Analysis `outputPrefix` is directly incorporated into filesystem paths without validation. `path.join()` normalizes traversal sequences such as `../`; it does not enforce that the resulting path remains beneath `WORKSPACE_DIR`. A prefix containing traversal components can therefore place generated screenshots in an existing writable directory outside the intended workspace. The output filename retains a fixed suffix such as `_page.png`, `_filled.png`, `_result.png`, or `_error.png`, which limits exact filename control but does not prevent directory traversal or out-of-scope file placement. The write occurs with the process's filesystem permissions. Existing files whose names match the generated suffix can be replaced by screenshot data. ### Attack Path 1. An attacker controls the `--prefix` argument or the `outputPrefix` API option. 2. The attacker supplies a value such as `../../shared/audit`. 3. The application ...[truncated 1010 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict `outputPrefix` to a basename with a conservative pattern, for example: ```javascript if (!/^[A-Za-z0-9_-]{1,64}$/.test(outputPrefix)) { throw new Error('Invalid output prefix'); } ``` 2. Resolve and verify every destination before writing: ```javascript const workspaceRoot = path.resolve(WORKSPACE_DIR); const destination = path.resolve( workspaceRoot, `${outputPrefix}_page.png` ); if ( destination !== workspaceRoot && !destination.startsWith(`${workspaceRoot}${path.sep}`) ) { throw new Error('Output path escapes the workspace'); } ``` 3. Reject prefixes containing path separators, traversal components, control characters, or absolute-path syntax. 4. Create a dedicated per-run directory under the workspace using a generated identifier. 5. Avoid replacing existing files by generating random filenames or checking for existing destinations. 6. Apply restrictive filesystem permissions to screenshots because they may contain sensitive page content. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.mjs:346
• Finding: Weak heuristics can fill and submit an unrelated webpage form<![CDATA[ ## Vulnerability Details **File Location**: `index.mjs:346-359`, `index.mjs:476-535` **Vulnerability Type**: Unsafe browser automation and unintended form submission **Risk Level**: High ### Complete Code Snippet The final input fallback selects the first suitable visible input even when it has not been verified as CAPTCHA-related: ```javascript for (const input of allInputs) { try { if (await input.isVisible()) { const type = await input.getAttribute('type'); if (type === 'hidden' || type === 'submit' || type === 'button') continue; const box = await input.boundingBox(); if (box && box.width > 50 && box.width < 400) { await input.fill(captchaText); console.log(`Filled the first visible input`); return true; } } } catch (e) {} } ``` The positional button fallback can click any visible nearby button: ```javascript if (!buttonFound && inputFound) { try { const inputs = await page.locator('input').all(); for (const input of inputs) { try { const inputBox = await input.boundingBox(); if (inputBox) { const buttons = await page.locator('button').all(); for (const btn of buttons) { try { const box = await btn.boundingBox(); if (box && await btn.isVisible()) { const verticalDist = Math.abs( (box.y + box.height / 2) - (inputBox.y + inputBox.height / 2) ); const horizontalDist = Math.abs( (box.x + box.width / 2) - (inputBox.x + inputBox.width / 2) ); if (verticalDist < 100 && horizontalDist < 300) { await btn.click(); buttonFound = true; break; } } } catch (e) {} } if (buttonFound) break; } } catch (e) {} } } catch (e ...[truncated 2250 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the “first visible input” fallback entirely. 2. Require multiple CAPTCHA-specific signals before filling a field, such as: - CAPTCHA-related `id`, `name`, `aria-label`, or placeholder. - Association with a verified CAPTCHA image. - Membership in the same form as that verified image. - A reasonable geometric relationship to that image. 3. Track the exact input locator that was filled and only inspect buttons belonging to that input's form. 4. Require strong semantic button evidence, not proximity alone. 5. Default to recognition-only behavior. Make form filling and submission separate opt-in operations. 6. Require user confirmation immediately before clicking a submit button. 7. Reject ambiguous pages rather than selecting a low-confidence candidate. 8. Return candidate selectors and confidence information to the caller so the caller can approve the action. 9. Add adversarial tests covering multiple forms, hidden decoys, misleading labels, and nearby unrelated buttons. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.mjs:591
• Finding: Chromium is launched with its process sandbox disabled<![CDATA[ ## Vulnerability Details **File Location**: `index.mjs:591-596` **Vulnerability Type**: Browser sandbox weakening **Risk Level**: High ### Complete Code Snippet ```javascript const browser = await chromium.launch({ headless: true, executablePath, args: [ '--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage' ] }); ``` ### Technical Analysis The Skill navigates to arbitrary caller-provided URLs while passing `--no-sandbox` and `--disable-setuid-sandbox` to Chromium. These flags remove an important process-isolation boundary designed to contain compromised renderer processes. Disabling the sandbox is not required by the declared CAPTCHA-recognition functionality. It is sometimes used as a compatibility workaround in constrained containers, but enabling it unconditionally on normal workstations substantially increases the impact of browser vulnerabilities. This setting is not independently a direct code-execution vulnerability. Exploitation requires a Chromium or browser-component vulnerability, but the configuration weakens defense in depth and can turn a renderer compromise into broader access under the account running the Skill. ### Attack Path 1. An attacker causes the Skill to visit an attacker-controlled URL through the required `--url` option or API input. 2. The page serves content designed to exploit a vulnerability in the installed Chrome or Chromium version. 3. The exploit compromises a browser renderer or another exposed component. 4. Because Chromium was launched without its normal sandbox, the compromised process has fewer isolation restrictions. 5. The attacker may access resources available to the Skill's operating-system user, subject to the specific browser exploit and remaining OS controls. ### Impact Assessment If combined with a suitable browser exploit, potential impact includes: - Reading or modifying files accessible to the running user. - Accessing OpenClaw workspace content and saved ...[truncated 376 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-sandbox` and `--disable-setuid-sandbox` from the default launch configuration: ```javascript const browser = await chromium.launch({ headless: true, executablePath, args: ['--disable-dev-shm-usage'] }); ``` 2. Run the browser as a dedicated unprivileged operating-system user. 3. Keep Chrome or Chromium updated with current security patches. 4. If sandbox disabling is unavoidable in a specialized container, require an explicit unsafe opt-in and display a prominent warning. 5. Place the entire Skill in an additional hardened container or virtual machine with: - A read-only root filesystem. - No host home-directory mount. - A dedicated writable screenshot directory. - Restricted outbound networking. - Dropped Linux capabilities. - Seccomp and mandatory access-control policies. 6. Avoid running the Skill as root. 7. Apply URL policy controls to reject unsupported schemes and optionally restrict navigation to approved origins. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (24)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ls -la ~/.openclaw/workspace/skills/captcha-auto/

# 如果装错了（在 ~/skills/），删除并重新安装
rm -rf ~/skills/captcha-auto
cd ~/.openclaw/workspace
clawhub install captcha-auto
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

ls -la ~/.openclaw/workspace/skills/captcha-auto/

# 如果装错了（在 ~/skills/），删除并重新安装
rm -rf ~/skills/captcha-auto
cd ~/.openclaw/workspace
clawhub install captcha-auto
```

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/run.mjs --url="https://example.com" --api-key="sk-xxx" --model="qwen3-vl-plus"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly requires environment variables and outbound network access to a third-party API, but its manifest does not declare any tool scope or permissions. This creates a transparency and least-privilege problem: an agent or user cannot accurately assess what the skill will access before installation or execution.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown file presents the skill description and operating instructions exclusively in Chinese, which effectively forces a specific language on users. The policy allows locale constraints only when users are given a choice or when the constraint is clearly justified as region-specific, neither of which is stated here.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

```bash
# 正确位置
ls -la ~/.openclaw/workspace/skills/captcha-auto/

# 如果装错了（在 ~/skills/），删除并重新安装
rm -rf ~/skills/captcha-auto

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

```bash
# 正确位置
ls -la ~/.openclaw/workspace/skills/captcha-auto/

# 如果装错了（在 ~/skills/），删除并重新安装
rm -rf ~/skills/captcha-auto

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Linux**：安装 Chromium
```bash
sudo apt install chromium-browser
```

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill sends a full-page screenshot to an external vision API even though its stated purpose is only captcha recognition. This can exfiltrate unrelated page contents such as personal data, session-bound content, or sensitive UI state to a third party, and the risk is amplified because the code explicitly automates browsing arbitrary URLs.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: After guessing an input field, the skill also guesses and clicks submit/verify/login buttons automatically. This expands the capability from passive captcha assistance into active page interaction, which can trigger unintended account actions, form submissions, authentication attempts, or workflow changes on arbitrary sites without explicit confirmation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill performs potentially state-changing clicks on likely submit or verify controls without any user confirmation step. In the context of arbitrary web automation, heuristic clicking can cause unauthorized or unintended actions, especially when selectors also match login or confirmation buttons.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The help text claims a local-OCR-first hybrid privacy-preserving flow, but the implementation always skips local OCR for the full-page flow and proceeds to the external vision model. This mismatch can mislead users about where their data goes, undermining informed consent and causing unexpected third-party disclosure of page content.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code presents user-facing instructions, help text, and status messages exclusively in Chinese. That creates a language/locale restriction without any opt-in, fallback, or justification that the skill is intended only for a Chinese-speaking audience.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file's user-facing help, logs, errors, and instructions are consistently presented in Chinese, with no indication that the user can choose another language. This is a natural-language policy concern when a skill imposes a locale without opt-in or a documented region-specific justification.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: A captcha recognition skill would reasonably need model credentials, but this implementation pulls them from broad ambient sources including process environment variables and a user-wide OpenClaw config file. That capability is not part of the stated functional purpose and increases access to unrelated local secrets/configuration.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language description is written entirely in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, locale or language constraints should be optional or clearly justified rather than implicitly imposed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "Lie Troksky and Aphrodite",
  "license": "MIT",
  "dependencies": {
    "playwright-core": "^1.40.0",
    "tesseract.js": "^5.0.0"
  },
  "scripts": {

• Confidence: 90% confidence
• Finding: Using a caret range for playwright-core allows installation of newer minor/patch releases that have not been explicitly reviewed, which weakens build reproducibility and increases supply-chain risk. In an automation skill that drives a browser, dependency drift could introduce vulnerable or malicious code paths affecting browser control, network access, or local execution context.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "playwright-core": "^1.40.0",
    "tesseract.js": "^5.0.0"
  },
  "scripts": {
    "test": "node index.mjs",

• Confidence: 94% confidence
• Finding: Using a non-pinned version for tesseract.js permits unreviewed dependency updates and reduces reproducibility, creating a supply-chain exposure. This skill processes CAPTCHA images and OCR content, so changes in the dependency tree could affect how untrusted image data is handled and may introduce vulnerable transitive packages.

Unverifiable Dependency: tesseract.js has 1 known advisory(ies) (GHSA-83rx-c8cr-6j8q (Insecure Default Configuration in tesseract.js)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The manifest references tesseract.js without pinning an exact version, while the package has a known advisory for insecure default configuration. Because the installed release is not fixed or constrained here, consumers may resolve to an affected version, which is especially relevant in a skill that accepts and OCR-processes externally sourced CAPTCHA images.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.mjs:44

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: index.mjs:39