Skill Smartcaptcha

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent SmartCaptcha integration guide, but it includes unsafe default validation and runnable example patterns that could weaken protected forms if copied unchanged.

Review this skill before installing or using it for production. Treat the SmartCaptcha provider calls and secret handling as normal for this integration, but do not copy the validation helpers unchanged for login, registration, payment, password reset, or other abuse-sensitive flows: make failure policy explicit, prefer fail-closed for sensitive actions, escape or return JSON for user-submitted output, restrict WebView origins and navigation, pin dependencies, and require deliberate approval before cloud resource deletion or broad Terraform/API changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: templates/validate.js:49

Finding

Systematic fail-open behavior bypasses CAPTCHA protection during validation failures

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: examples/express-fullstack/server.js:84

Finding

Reflected cross-site scripting in runnable Express and Flask examples

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/mobile-android.md:45

Finding

Android WebView JavaScript bridge is exposed without mandatory origin and navigation restrictions

Content

View full analysis

(R.id.webViewCaptcha) webView.loadUrl("URL_страницы_с_капчей?sitekey=<ключ_клиента>") ``` The hosted page invokes the bridge as follows: ```javascript function sendToNative(androidMethod, iosMethod, data) { if (window.NativeClient && window.NativeClient[androidMethod]) { if (data !== undefined) { window.NativeClient[androidMethod](data); } else { window.NativeClient[androidMethod](); } } else if (window.webkit && window.webkit.messageHandlers) { window.webkit.messageHandlers.NativeClient.postMessage({ method: iosMethod, data: data !== undefined ? data : "" }); } } ``` ### Technical Analysis `addJavascriptInterface` exposes annotated native methods to JavaScript executing in the WebView. The instructions do not require: - An exact HTTPS origin allowlist. - A `WebViewClient` that rejects unexpected navigation. - Rejection of redirects to untrusted origins. - Disabling mixed content and local file access. - Removal of the bridge before loading other content. The current bridge methods are narrow, which limits immediate impact. Nevertheless, any document executing in the bridged WebView can attempt to invoke `NativeClient`. If a hosted page, redirect, compromised resource, or navigation takes the WebView to attacker-controlled content, that content can spoof CAPTCHA callbacks. The risk would become ...[truncated 1686 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: examples/flask-fullstack/requirements.txt:2

Finding

Dependency manifests permit installation of unaudited future package versions

Content

View full analysis

=3.0 requests>=2.31 ``` Node.js dependency: ```json "dependencies": { "express": "^4.19.2" } ``` The project contains no corresponding dependency lockfile in the supplied directory structure. ### Technical Analysis The Python manifest permits any future Flask or Requests release satisfying the lower bound, including future major versions. The Node.js caret constraint permits newer compatible releases in the selected major version. Because no lockfile or hash-locked manifest is included, two users installing the examples at different times may execute different dependency code. The packages and registries shown are legitimate; there is no evidence of typosquatting, dependency confusion, or an intentionally malicious package. The risk is that installation commands can resolve code that did not exist at audit time and has not been reviewed with this project. This weakens reproducibility and increases exposure to compromised upstream releases, unexpected breaking changes, or newly introduced vulnerabilities. ### Attack Path 1. A user follows the documented `npm install` or `pip install -r requirements.txt` command. 2. The package manager resolves versions available at installation time rather than versions reviewed during this audit. 3. A future vulnerable, compromised, or behaviorally incompatible release satisfies the broad version range. 4. The dependency is installed and executed by the example application. 5. Any malicious or vulnerable dependency behavior runs with the application's process permissions and access to its environment, including the SmartCaptcha server key. This is a supply-chain exposure rather than proof that th ...[truncated 542 chars]

Remediation

View remediation

--hash=sha256: ``` 4. Separate human-edited top-level requirements from a generated, fully resolved deployment lockfile. 5. Use automated dependency-update tooling that opens reviewed changes and runs tests rather than resolving arbitrary future versions during deployment. 6. Run dependency vulnerability scanning in continuous integration. 7. Document the runtime and package-manager versions used to generate lockfiles. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (119)

Tainted flow: 'SMARTCAPTCHA_SERVER_KEY' from os.environ.get (line 9, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/flask-fullstack/app.py (reported line 29)May include surrounding context.

python

Поле message — только для диагностики, не сравнивайте его в коде.
    """
    try:
        resp = requests.post(
            "https://smartcaptcha.yandexcloud.net/validate",
            data={
                "secret": SMARTCAPTCHA_SERVER_KEY,

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/captcha-management.md (reported line 152)May include surrounding context.

md

* Консоль: выбери капчу → меню **...** → **Удалить** → подтверди.
* CLI: `yc smartcaptcha captcha delete <имя_или_идентификатор_капчи>`.
* Terraform: удали блок `resource "yandex_smartcaptcha_captcha"` из конфигурации и выполни `terraform apply`.
* API: `DELETE /smartcaptcha/v1/captchas/{captchaId}` (метод `Captcha.Delete`).

## Роли доступа

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guidance says an empty host in /validate can be treated as trusted, even though the same section warns that disabling domain validation requires strict server-side host checks. If implementers follow this advice, attackers may be able to bypass origin validation during service failure or ambiguous conditions, allowing tokens from unexpected origins to be accepted.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/express-fullstack/public/index.html (reported line 1)May include surrounding context.

html

<!-- Страница с формой и автоматическим виджетом SmartCaptcha. Подробности: ../../../docs/widget-auto.md -->
<!DOCTYPE html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/express-fullstack/public/index.html (reported line 1)May include surrounding context.

html

<!-- Cтpaницa c фopмoй и aвтoмaтичecким виджeтoм SmartCaptcha. Пoдpo6нocти: ../../../docs/widget-auto.md -->
<!DOCTYPE html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/flask-fullstack/templates/index.html (reported line 1)May include surrounding context.

html

<!-- Шаблон Jinja2: форма с автоматическим виджетом SmartCaptcha. Подробности: ../../../docs/widget-auto.md -->
<!DOCTYPE html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/flask-fullstack/templates/index.html (reported line 1)May include surrounding context.

html

<!-- Шa6лoн Jinja2: фopмa c aвтoмaтичecким виджeтoм SmartCaptcha. Пoдpo6нocти: ../../../docs/widget-auto.md -->
<!DOCTYPE html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/express-fullstack/public/index.html (reported line 8)May include surrounding context.

html

<meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>SmartCaptcha: пример Flask</title>
  <!-- captcha.js сам найдет все div с классом smart-captcha и отрисует в них виджет -->
  <script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>
</head>
<body>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/flask-fullstack/templates/index.html (reported line 8)May include surrounding context.

html

<meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>SmartCaptcha: пример Flask</title>
  <!-- captcha.js сам найдет все div с классом smart-captcha и отрисует в них виджет -->
  <script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>
</head>
<body>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/express-fullstack/public/index.html (reported line 8)May include surrounding context.

html

<meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>SmartCaptcha: пpимep Flask</title>
  <!-- captcha.js caм нaйдeт вce div c клaccoм smart-captcha и oтpиcyeт в ниx виджeт -->
  <script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>
</head>
<body>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/flask-fullstack/templates/index.html (reported line 8)May include surrounding context.

html

<meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>SmartCaptcha: пpимep Flask</title>
  <!-- captcha.js caм нaйдeт вce div c клaccoм smart-captcha и oтpиcyeт в ниx виджeт -->
  <script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>
</head>
<body>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This finding appears to involve visually confusable Cyrillic/Latin substitutions in comment text ('Пoдпиcкa...' instead of normal Russian spelling), which is a known obfuscation technique. Even though the payload here is not itself malicious, hidden or spoofed text in skill documentation can evade review, conceal instructions, or create ambiguity for downstream tooling and auditors.

Content

Scanner excerpt · references/js-api.md (reported line 54)May include surrounding context.

Пример подписки

html

<!-- Подписка на событие виджета; подробности — в ../docs/widget-advanced.md -->
<div id="container"></div>

<script src="https://smartcaptcha.yandexcloud.net/captcha.js?render=onload&onload=onloadFunction" async defer></script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This finding appears to involve visually confusable Cyrillic/Latin substitutions in comment text ('Пoдпиcкa...' instead of normal Russian spelling), which is a known obfuscation technique. Even though the payload here is not itself malicious, hidden or spoofed text in skill documentation can evade review, conceal instructions, or create ambiguity for downstream tooling and auditors.

Content

Scanner excerpt · references/js-api.md (reported line 54)May include surrounding context.

Пpимep пoдпиcки

html

<!-- Пoдпиcкa нa co6ытиe виджeтa; пoдpo6нocти — в ../docs/widget-advanced.md -->
<div id="container"></div>

<script src="https://smartcaptcha.yandexcloud.net/captcha.js?render=onload&onload=onloadFunction" async defer></script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/invisible.html (reported line 1)May include surrounding context.

html

<!-- Шаблон: страница с невидимой Yandex SmartCaptcha (invisible: true, execute() по submit формы). Подробности: docs/invisible-captcha.md -->
<!doctype html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/invisible.html (reported line 1)May include surrounding context.

html

<!-- Шa6лoн: cтpaницa c нeвидимoй Yandex SmartCaptcha (invisible: true, execute() пo submit фopмы). Пoдpo6нocти: docs/invisible-captcha.md -->
<!doctype html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 76% confidence

Finding

This finding indicates a homoglyph/obfuscated variant of the same hidden comment, mixing Latin-looking and Cyrillic-looking characters. Even though the visible content appears harmless, such obfuscation can conceal instructions from reviewers and automated tools, which is especially sensitive in agent-skill content where hidden text may be used to manipulate downstream analysis or behavior.

Content

Scanner excerpt · templates/widget-advanced.html (reported line 1)May include surrounding context.

html

<!-- Шаблон: расширенный метод подключения SmartCaptcha — отложенная загрузка скрипта,
     window.smartCaptcha.render с callback, отправка токена на бэкенд fetch'ем.
     Подробности: docs/widget-advanced.md -->
<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 76% confidence

Finding

This finding indicates a homoglyph/obfuscated variant of the same hidden comment, mixing Latin-looking and Cyrillic-looking characters. Even though the visible content appears harmless, such obfuscation can conceal instructions from reviewers and automated tools, which is especially sensitive in agent-skill content where hidden text may be used to manipulate downstream analysis or behavior.

Content

Scanner excerpt · templates/widget-advanced.html (reported line 1)May include surrounding context.

html

<!-- Шa6лoн: pacwиpeнный мeтoд пoдключeния SmartCaptcha — oтлoжeннaя зarpyзкa cкpиптa,
     window.smartCaptcha.render c callback, oтпpaвкa тoкeнa нa 6экeнд fetch'eм.
     Пoдpo6нocти: docs/widget-advanced.md -->
<!DOCTYPE html>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/widget-auto.html (reported line 1)May include surrounding context.

html

<!-- Шаблон: HTML-страница с формой входа и автоматическим виджетом Yandex SmartCaptcha. Подробности: docs/widget-auto.md -->
<!DOCTYPE html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/widget-auto.html (reported line 1)May include surrounding context.

html

<!-- Шa6лoн: HTML-cтpaницa c фopмoй вxoдa и aвтoмaтичecким виджeтoм Yandex SmartCaptcha. Пoдpo6нocти: docs/widget-auto.md -->
<!DOCTYPE html>
<html lang="ru">
<head>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/widget-auto.html (reported line 9)May include surrounding context.

html

<meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Вход</title>

  <!-- Скрипт виджета: после загрузки сам найдет все div с классом smart-captcha
       и отрисует в них виджет. defer — чтобы не блокировать отрисовку страницы. -->
  <script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/widget-auto.html (reported line 9)May include surrounding context.

html

<meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Bxoд</title>

  <!-- Cкpипт виджeтa: пocлe зarpyзки caм нaйдeт вce div c клaccoм smart-captcha
       и oтpиcyeт в ниx виджeт. defer — чтo6ы нe 6лoкиpoвaть oтpиcoвкy cтpaницы. -->
  <script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/widget-auto.html (reported line 40)May include surrounding context.

html

<input id="userpass" type="password" name="password" required>
    </p>

    <!-- Контейнер виджета капчи.
         ЗАМЕНИТЕ <ключ_клиента> на «Ключ клиента» со страницы капчи
         в консоли Yandex Cloud (вкладка «Обзор»).
         height: 100px задана заранее: при загрузке виджет меняет высоту

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/widget-auto.html (reported line 40)May include surrounding context.

html

<input id="userpass" type="password" name="password" required>
    </p>

    <!-- Koнтeйнep виджeтa кaпчи.
         3AMEHИTE <ключ_клиeнтa> нa «Kлюч клиeнтa» co cтpaницы кaпчи
         в кoнcoли Yandex Cloud (вклaдкa «O6зop»).
         height: 100px зaдaнa зapaнee: пpи зarpyзкe виджeт мeняeт выcoтy

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill clearly instructs use of environment secrets and outbound network access, but it declares no explicit tool/permission scope. In an agent platform, that can cause overbroad execution capability, making it easier for the skill to access secrets or call external endpoints without clear least-privilege boundaries.

Content

No source excerpt is available for this finding.