CapMonster CAPTCHA Solver

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:39 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed CAPTCHA-solving helper, but it should be reviewed carefully because it enables bypassing website anti-abuse checks on arbitrary pages.

Install only if you have explicit authorization to solve CAPTCHAs for the target sites and are comfortable sending target URLs, sitekeys, and your CapMonster API key to CapMonster Cloud. Use spending limits and do not run the token-injection or form-submission steps against third-party services where automation or CAPTCHA bypass is not permitted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: solve-recaptcha.sh:25

Finding

Unescaped Arguments Permit CapMonster JSON Request Manipulation

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi case "$WEBSITE_URL" in http://*|https://*) ;; *) echo "website_url must use HTTP or HTTPS" >&2 exit 1 ;; esac PAYLOAD=$(jq -n \ --arg key "$CAPMONSTER_API_KEY" \ --arg url "$WEBSITE_URL" \ --arg sitekey "$SITEKEY" \ '{ clientKey: $key, task: { type: "RecaptchaV2TaskProxyless", websiteURL: $url, websiteKey: $sitekey } }') RESPONSE=$(curl --fail-with-body -sS \ -X POST https://api.capmonster.cloud/createTask \ -H 'Content-Type: application/json' \ --data-binary "$PAYLOAD") ``` Additional hardening should include: 1. Reject missing API keys before making network requests. 2. Restrict target URLs to `http` and `https`; apply a domain allowlist when automation is intended only for approved sites. 3. Validate site-key length and permitted character format before submission. 4. Use `curl --fail-with-body -sS` and explicitly handle transport and HTTP errors. 5. Confirm that `.taskId`, `.errorId`, and result fields have the expected types before using them. 6. Apply account-side spending limits, balance alerts, and API-key rotation procedures to reduce billing exposure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description says the skill solves reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile, and image CAPTCHAs via CapMonster Cloud API. The supplied code is a browser-side detection script: it queries the DOM for CAPTCHA widgets/iframes/scripts, extracts possible sitekeys, infers challenge pages from body text, and returns structured detection results. There is no API call, no submission to a solving service, no retrieval of solved tokens, and no handling of image CAPTCHA recognition. This is a material description-behavior mismatch because the primary purpose implemented is detection/inspection, not solving.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description says the skill solves multiple CAPTCHA types using the CapMonster Cloud API. The supplied code does something narrower and different: it accepts an already-obtained token, writes it into known response fields, and optionally calls site-defined callbacks to submit that token. There is no network/API interaction with CapMonster Cloud, no CAPTCHA challenge solving logic, and no support for image CAPTCHA recognition. While token injection is related to CAPTCHA workflows, the primary purpose and capabilities of this code are materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broader CAPTCHA-solving capability across several challenge types, but the supplied code implements only a single narrow case: reCAPTCHA v2 proxyless solving. Its primary purpose is related to CAPTCHA solving and it does use CapMonster Cloud as described, so there is partial alignment. However, the represented supported CAPTCHA types are materially overstated relative to the actual code chunk. No unrelated triggers or suspicious extra capabilities are present; the mismatch is due to under-implementation versus the declared scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document goes beyond solving CAPTCHAs and explicitly instructs token injection, callback triggering, and form submission on challenged pages. That is dangerous because it operationalizes anti-abuse bypass on third-party sites and can directly support unauthorized scraping, account abuse, or automation against protected workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill demonstrates shell/network capabilities but does not declare an explicit tool scope or permissions boundary. That omission weakens governance and review because a consumer may not realize the skill can make outbound requests and run shell commands involving secrets such as the CapMonster API key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs sending target website URLs, site keys, and an API credential to a third-party CAPTCHA-solving provider without any privacy, compliance, or data-sharing warning. This can expose operational metadata about browsing targets and normalizes external transmission of challenge data and secrets-related workflows without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This snippet performs outbound transmission of the CapMonster API key to an external service. While expected for the product's function, it is still a real security-relevant behavior because it involves secret use over the network and should be explicitly governed and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Check Balance

bash

curl -s -X POST https://api.capmonster.cloud/getBalance \
  -H "Content-Type: application/json" \
  -d '{"clientKey": "${CAPMONSTER_API_KEY}"}' | jq .balance

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This snippet performs outbound transmission of the CapMonster API key to an external service. While expected for the product's function, it is still a real security-relevant behavior because it involves secret use over the network and should be explicitly governed and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Check Balance

bash

curl -s -X POST https://api.capmonster.cloud/getBalance \
  -H "Content-Type: application/json" \
  -d '{"clientKey": "${CAPMONSTER_API_KEY}"}' | jq .balance

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill provides detailed instructions for extracting site keys from third-party pages and preparing downstream CAPTCHA-bypass workflows. In context, this materially facilitates bypass of anti-bot controls on external services, expanding the skill beyond benign API usage into actionable evasion guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The createTask call sends target website information and challenge parameters to a third-party API. In this skill's context, that externalizes data about third-party sites and supports CAPTCHA-solving for protected pages, which raises both data-sharing and abuse-enablement concerns.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

Step 3: Submit to CapMonster API

Using curl (shell):

bash

# Create task

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The all-in-one shell script packages the external CAPTCHA-solving workflow into a ready-to-run automation utility. That increases misuse risk by lowering the barrier to sending challenge data and solving requests to a third party for use against protected sites.

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md

# Create task
echo "Creating task..."
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The all-in-one shell script packages the external CAPTCHA-solving workflow into a ready-to-run automation utility. That increases misuse risk by lowering the barrier to sending challenge data and solving requests to a third party for use against protected sites.

Content

Scanner excerpt · SKILL.md (reported line 392)May include surrounding context.

md

# Create task
echo "Creating task..."
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · detect-captcha.js (reported line 37)May include surrounding context.

js

result.hasCaptcha = true;
    result.type = 'recaptcha_v3';
    result.sitekey = recaptchaV3Script.src.match(/render=([^&]+)/)?.[1];
    result.details.note = 'v3 is invisible, auto-executes on page load';
  }

  // hCaptcha detection

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This script is explicitly designed to inject CAPTCHA solution tokens into page fields and invoke page-defined verification callbacks, thereby modifying a site's anti-abuse verification state. Even if intended for legitimate browser automation, it facilitates CAPTCHA bypass behavior and directly executes arbitrary page callback functions discovered from DOM attributes or internal reCAPTCHA structures, which increases abuse potential and can violate site security controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends the CapMonster API key to a third-party service without first validating that the credential is present or warning the operator that it will be transmitted off-host. Although transmitting an API key to its intended provider is expected for this functionality, the lack of explicit validation and disclosure increases the risk of accidental misuse, debugging confusion, and unreviewed credential exposure in automation contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script transmits websiteURL and websiteKey to CapMonster Cloud, a third-party CAPTCHA-solving provider, without any explicit privacy or network disclosure to the operator. In this skill context that data sharing is inherent to the service, but it still matters because users may unknowingly send browsing targets or customer/internal URLs to an external vendor.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

# Create task
echo "🔄 Creating task for: $WEBSITE_URL"
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

# Create task
echo "🔄 Creating task for: $WEBSITE_URL"
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 416)May include surrounding context.

md

# Create task
echo "🔄 Creating task for: $WEBSITE_URL"
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · solve-recaptcha.sh (reported line 24)May include surrounding context.

sh

# Create task
echo "🔄 Creating task for: $WEBSITE_URL"
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · solve-recaptcha.sh (reported line 48)May include surrounding context.

sh

# Create task
echo "🔄 Creating task for: $WEBSITE_URL"
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · solve-recaptcha.sh (reported line 24)May include surrounding context.

sh

# Create task
echo "🔄 Creating task for: $WEBSITE_URL"
RESPONSE=$(curl -s -X POST https://api.capmonster.cloud/createTask \
  -H "Content-Type: application/json" \
  -d "{
    \"clientKey\": \"$API_KEY\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

# Poll for result
echo -n "⏳ Waiting for solution"
for i in {1..60}; do
  RESULT=$(curl -s -X POST https://api.capmonster.cloud/getTaskResult \
    -H "Content-Type: application/json" \
    -d "{\"clientKey\": \"$API_KEY\", \"taskId\": $TASK_ID}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 416)May include surrounding context.

md

# Poll for result
echo -n "⏳ Waiting for solution"
for i in {1..60}; do
  RESULT=$(curl -s -X POST https://api.capmonster.cloud/getTaskResult \
    -H "Content-Type: application/json" \
    -d "{\"clientKey\": \"$API_KEY\", \"taskId\": $TASK_ID}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · solve-recaptcha.sh (reported line 48)May include surrounding context.

sh

# Poll for result
echo -n "⏳ Waiting for solution"
for i in {1..60}; do
  RESULT=$(curl -s -X POST https://api.capmonster.cloud/getTaskResult \
    -H "Content-Type: application/json" \
    -d "{\"clientKey\": \"$API_KEY\", \"taskId\": $TASK_ID}")

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: SKILL.md:44