Security audit

captcha-login-assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates CAPTCHA-protected logins and retries, which can weaken anti-bot protections and expose credentials without enough scoping or user controls.

Install only if you will use it on systems you own or are explicitly authorized to administer or test. Avoid using it for third-party sites, credential lists, password guessing, or rate-limit evasion; prefer manual CAPTCHA completion, strict retry limits, and deletion of screenshots or logs that may contain secrets.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:26
Finding: Automated CAPTCHA Circumvention in Login Workflow
Content: View full analysis
{\n const username = document.querySelector('input[name=\"username\"]');\n const password = document.querySelector('input[name=\"password\"]');\n const verifyCode = document.querySelector('input[name=\"verifyCode\"]');\n \n if (username) {\n username.value = 'your_username';\n username.dispatchEvent(new Event('input', { bubbles: true }));\n }\n if (password) {\n password.value = 'your_password';\n password.dispatchEvent(new Event('input', { bubbles: true }));\n }\n if (verifyCode) {\n verifyCode.value = 'recognized_captcha';\n verifyCode.dispatchEvent(new Event('input', { bubbles: true }));\n }\n return 'filled';\n }" }) ``` #### Step 5: Click Login Button ```javascript // Click login button mcp_chrome-devtools-mcp_evaluate_script({ "function": "() => {\n const loginBtn = document.querySelector('button[type=\"submit\"]') || document.querySelector('button');\n if (loginBtn) {\n loginBtn.click();\n return 'login_clicked';\n }\n return 'button_not_found';\n }" }) ``` ``` The retry guidance further states: ```markdown If login fails showing "CAPTCHA verification failed": 1. Immediately ...[truncated 2802 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is framed as a general-purpose CAPTCHA login automation workflow with no requirement to verify authorization, ownership, or approved scope before use. Because it can be applied to arbitrary login endpoints, it materially lowers the barrier to automating access attempts against third-party systems and enables misuse in unauthorized contexts.
Content: No source excerpt is available for this finding.

Ssd 4

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow teaches the agent to solve CAPTCHA challenges from screenshots, inject the recognized code, submit the login form, and retry when verification fails. CAPTCHA is an authentication safeguard intended to slow automated access, so normalizing repeated solving and resubmission meaningfully facilitates bypass of anti-automation controls and can support credential-stuffing or account takeover attempts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to capture screenshots of login pages and programmatically fill usernames and passwords, but it does not clearly warn that credentials and page contents will be transmitted to external/browser tooling and may be exposed in artifacts or logs. This creates a real risk of sensitive credential disclosure and mishandling of authentication data during automated execution.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:54