ClawHub
Back to skill

Security audit

CapSolver

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it solves anti-bot challenges by sending API keys, proxy credentials, page data, and challenge/session material to a third-party service with limited safety disclosure.

Install only if you intentionally want a third-party CAPTCHA/anti-bot solving service and are authorized to use it on the target sites. Treat the CapSolver API key, proxy credentials, WAF tokens, returned cookies, page HTML, and challenge data as sensitive; avoid putting secrets directly on the command line or in shared logs, and use an isolated environment with reviewed dependency versions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/solver.py:383
Finding

Sensitive credentials and task data exposed through command-line arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Dependencies are installed using unbounded versions without integrity verification

Content
View full analysis
=2.32.4 python-dotenv>=0.9.9 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Both dependencies use open-ended lower bounds. Consequently, any future release satisfying the minimum version can be selected during installation. The project does not provide a lock file, exact transitive versions, or package hashes. The reviewed package names are established packages, and the audit found no evidence of typosquatting, dependency confusion, malicious package sources, or currently malicious dependency code. Nevertheless, open-ended resolution means the exact code installed can change after this Skill has been reviewed. Without hashes, the installation process does not verify that resolved artifacts match artifacts approved by the project. This weakens reproducibility and increases exposure to compromised future releases, unexpected dependency changes, and incompatible transitive updates. ### Attack Path 1. A future direct or transitive dependency release satisfying the declared lower bounds becomes compromised or introduces unsafe behavior. 2. A user follows the README and runs `pip install -r requirements.txt`. 3. The package manager resolves the newer release because no upper or exact version is specified. 4. No project-provided hash prevents installation of the unreviewed artifact. 5. Package installation or later import executes the dependency under the privileges of the user running the Skill. This is a supply-chain risk rather than evidence that the currently named packages are malicious. ### Impact Assessment A compromised dependency can execute code during installation or import with the privileges of the invoking user. Depending on thos ...[truncated 540 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

  1. Create a .env file in the root directory based on the .env.example file:
bash
cp .env.example .env
  1. Add your CapSolver API key to the .env file:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: capsolver
description: Use capsolver to automatically resolve Geetest, reCAPTCHA v2, reCAPTCHA v3, MTCaptcha, DataDome, AWS WAF, Cloudflare Turnstile, and Cloudflare Challenge, etc.
homepage: https://capsolver.com/
credentials:
  - API_KEY
env:
  required:
    - API_KEY
---

# CapSolver Skill

Use this skill to automatically resolve various CAPTCHA challenges using the CapSolver API service. The skill supports Geetest, reCAPTCHA v2/v3, MTCaptcha, DataDome, AWS WAF, Cloudflare Turnstile, Cloudflare Challenge, and more.

**Authentication:** Set `API_KEY` in your environment or in a `.env` file in the repo

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/solver.py (reported line 18)May include surrounding context.

python
import requests
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/solver.py (reported line 52)May include surrounding context.

python
import requests
from dotenv import load_dotenv

# Load environment variables from .env file
load_dotenv()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README instructs users to handle API keys, proxies, cookies, and captured HTML used in anti-bot/captcha-solving workflows, but provides no warning about storing, transmitting, or redacting sensitive data. In this context, those artifacts can contain secrets, session tokens, identifying browser data, or full challenge pages, increasing the risk of accidental credential leakage, privacy violations, or misuse of live session material.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents use of environment variables and outbound network access to a third-party CAPTCHA-solving API, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and transparency, making it easier for an agent or user to invoke networked behavior and secret access without clear policy boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill sends CAPTCHA images, page URLs, user-agent values, HTML challenge pages, cookies, and similar browsing artifacts to an external service, but the description does not warn users that this data leaves their environment. That creates a privacy and compliance risk because sensitive browsing/session data may be transmitted to a third party without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This outbound POST transmits collected task data to a third-party API, including the clientKey and potentially sensitive challenge material, HTML, proxy details, or session-related values. In a captcha-solving skill, this external transmission is inherent to functionality, but it still creates a real data exposure boundary and can facilitate abuse of anti-bot bypass workflows.

Content

Scanner excerpt · scripts/solver.py (reported line 217)May include surrounding context.

python
raise TypeError(f"Unsupported type: {args.command}")

    def create_task(self) -> tuple[str, Any]:
        response = requests.post(
            f"{self.api_base}{self.create_task_endpoint}",
            headers=self.headers,
            json=self.create_task_payload,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends the API key plus user-supplied captcha, challenge, proxy, and session-related data to capsolver.com as part of normal operation, but it does so without any explicit runtime warning or consent mechanism about third-party disclosure. In this skill’s context, that is more concerning because the tool is specifically designed to bypass anti-bot controls and may transmit sensitive tokens, cookies, HTML, or challenge artifacts from other sites to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This POST sends the API key and task identifier to the external service to retrieve results. Although less sensitive than the initial task submission, it still transmits credentials to a third party and continues a workflow intended to solve or bypass access controls.

Content

Scanner excerpt · scripts/solver.py (reported line 257)May include surrounding context.

python
def get_task_result(self, task_id: str) -> Optional[Dict[str, Any]]:
        self.get_task_result_payload['taskId'] = task_id
        response = requests.post(
            f"{self.api_base}{self.get_task_result_endpoint}",
            headers=self.headers,
            json=self.get_task_result_payload,

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a lower-bound specifier only, which makes builds non-reproducible and allows installation of different versions over time. In a security-sensitive skill that interacts with anti-bot and challenge-solving services, this increases supply-chain risk and makes it hard to verify whether a safe or vulnerable version of requests is actually deployed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.32.4
python-dotenv>=0.9.9

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

requests has multiple known advisories across historical versions, and because the manifest does not pin a specific release, it is impossible to verify from this file whether deployment will avoid affected versions. The risk is amplified by the network-heavy nature of this skill, since requests is likely a core runtime dependency handling outbound HTTP interactions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

python-dotenv is also unpinned, so installations may resolve to different versions depending on timing and environment. This weakens reproducibility and can silently introduce vulnerable or incompatible releases, which is avoidable in production-oriented skills.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests>=2.32.4
python-dotenv>=0.9.9

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

python-dotenv has known advisories in some versions, and the unpinned requirement prevents verification that a safe release will be installed. If dotenv file handling is used by the skill, a vulnerable version could affect local file safety or configuration integrity depending on how environment files are managed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The code automatically loads a .env file and reads API_KEY from the environment for authentication. Although this is functionally expected, there is no explicit user-facing warning in the main help text that local credentials will be consumed automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.