other
Warning
- Location
- SKILL.md:21
- Finding
- Automated CAPTCHA Handling and Sensitive Identity Verification Data Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–32 **Vulnerability Type**: Anti-automation control bypass and sensitive identity-data handling **Risk Level**: Medium ### Complete Vulnerable Snippet ```text 1. Click "Mobile phone verification" → Popup tab opens 2. Check popup tab targetId (query tabs) 3. Select carrier radio: click via evaluate - document.querySelectorAll('input[type=radio]')[0].click() // SKT - [1] = KT, [2] = LGU+ 4. Agree all: document.querySelectorAll('input[type=checkbox]')[0].click() 5. Click "Verify with SMS" 6. Enter name, birthdate(6 digits), 7th digit of SSN, phone number, security characters 7. Read security characters via screenshot 8. "Confirm" → Enter SMS verification code → "Confirm" 9. In main tab, agree to seller terms → "Expert registration complete" ``` ### Technical Analysis The skill instructs an AI agent to automate a PASS identity-verification workflow, interpret security characters from a screenshot, and enter an SMS verification code. Reading CAPTCHA-like security characters from an image is an attempt to automate a control designed to distinguish human interaction from automated activity. The workflow also places multiple sensitive data elements within the agent and browser execution context: - Name - Birth date - Seventh digit of a national identification number - Telephone number - CAPTCHA or security characters - One-time SMS verification code Although the file does not explicitly instruct the agent to exfiltrate or persist this information, processing it through screenshots, browser automation, agent context, or execution logs expands the number of components that can observe it. The instructions contain no requirements for redaction, restricted logging, screenshot deletion, retention limits, or user-controlled entry of authentication factors. This issue does not match T01–T09 directly. No malicious executable code, privilege escalation, persistence, dependency attack, remote ...[truncated 1899 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Require direct user interaction for anti-automation challenges** - Do not capture, analyze, transcribe, or automatically submit CAPTCHA or security-character challenges. - Pause the workflow and require the user to complete the challenge directly in the trusted browser interface. 2. **Keep authentication factors outside agent context** - Require the user to enter SMS verification codes directly. - Do not expose one-time codes through prompts, screenshots, tool parameters, browser traces, or model-visible logs. 3. **Minimize sensitive data processing** - Collect only fields strictly required by the verification provider. - Prefer direct user entry for national identifier digits, birth dates, telephone numbers, and similar identity information. - Do not copy these values into workspace files, environment variables, prompts, or persistent memory. 4. **Apply logging and screenshot controls** - Disable screenshots while identity fields or verification codes are visible. - Redact sensitive form fields from browser traces and diagnostic output. - Prevent retention of screenshots, session recordings, and tool logs containing verification information. - Define short retention periods and securely delete temporary artifacts. 5. **Add consent and authorization checks** - Require explicit confirmation that the user is registering their own identity and is authorized to create the account. - Display the actions that will be performed before initiating verification. - Require a final user confirmation before accepting seller terms or completing registration. 6. **Respect platform anti-automation requirements** - Review the terms and automation policies of Kmong, Google, and PASS. - Restrict automation to supported APIs or explicitly permitted browser operations. - Document that CAPTCHA circumvention is prohibited. ]]>