Security audit
mdac-filler
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims (automates MDAC form filling) and is internally coherent, but it explicitly implements a client-side CAPTCHA bypass and requires running injected JavaScript in a real browser — behavior that is potentially abusive, may violate site terms or law, and deserves caution.
This skill appears to perform the claimed automation, but it explicitly bypasses the MDAC slider CAPTCHA by hooking page JS and simulating mouse movements. Consider the following before installing or running it: - Legal/TOS: Bypassing CAPTCHA or automating submissions can violate a website's terms of service and, in some jurisdictions, may be illegal. Verify that automating MDAC submissions is permitted. - Source trust: The package/source is unknown. Review the included script (scripts/fill_and_submit.py) yourself before running. The code runs locally but will execute arbitrary JS in a browser context — only run it if you trust the author. - Sensitive data: You must supply passport number, DOB, email, phone, etc. Only provide real personal data after you are confident the code is safe and runs locally (not sending data elsewhere). - Installation risks: Playwright will download Chromium; run installs in a controlled environment and keep your OS/browser up to date. - Safer practices: Run a code review or run the script in an isolated VM or disposable machine first. Test with dummy data. If you are uncomfortable with CAPTCHA bypass capability, do not install; prefer tools that do not attempt to circumvent anti-bot measures. If you want more assurance, provide the skill's origin URL or a cryptographic release (GitHub repo/tag) so you (or an auditor) can verify provenance and check for tampering.
Static analysis
No suspicious patterns detected.