MDAC Auto-Filler

Auto-fill and submit Malaysia Digital Arrival Card (MDAC) for travelers entering Malaysia. Use when a user wants to fill or submit MDAC (马来西亚数字入境卡) for Malay...

Security Scan

The skill's code and instructions match its stated purpose (automating MDAC form filling and bypassing its slider CAPTCHA); it does not request unrelated credentials or contact external services, but it explicitly implements a CAPTCHA bypass which you should be aware of before use.

Purpose & Capability

Name/description, SKILL.md and the Python script align: the project launches a real browser via Playwright, injects JS to fill fields, reads slider state, simulates a human drag, and submits the MDAC form. There are no unrelated environment variables, binaries, or external services required.

Instruction Scope

Runtime instructions and the script instruct the agent to inject JavaScript into the MDAC site, patch the site's $.ajax to short-circuit /captcha verification, read the slider instance.x coordinate, and simulate mouse movements to pass the CAPTCHA. This behavior is within the stated goal (auto-solving CAPTCHA to submit the form) but is notable because it actively modifies the target site's client-side behavior to bypass bot protections. The instructions do not read or transmit data to third-party endpoints.

Install Mechanism

No install spec in the registry; the README and SKILL.md require installing Playwright and Chromium (pip + playwright install). That is a standard requirement for browser automation and consistent with the skill's function. No arbitrary downloads from unknown hosts are present in the package.

Credentials

The skill declares no required environment variables or credentials. It does require user-supplied traveler data (passport, DOB, email, phone) which is appropriate for the task. The README warns to avoid passing sensitive data on the command line and suggests using a local file with restricted permissions—this is appropriate guidance.

Persistence & Privilege

The skill is user-invocable, not always-enabled, and does not request persistent presence or modify other skills or system-wide settings. It runs Playwright locally and only interacts with the MDAC website in the browser context.

Assessment

What you should consider before installing or running this skill: - The skill intentionally bypasses the MDAC slider CAPTCHA by patching client-side code and simulating human mouse movement. Although this matches the stated purpose, bypassing CAPTCHAs may violate the target site's terms of service or local laws — proceed only if you accept that risk. - The script runs a real browser (Playwright + Chromium) locally and injects JS into the official MDAC site; it does not contact third-party servers. Still, review the code yourself if you can and run it on a machine you control. - Protect your sensitive data: do not pass passport or personal data on the command line (use --file as recommended) and set file permissions (chmod 600). Be aware command-line arguments may appear in process lists and shell history. - Running automated submissions can lead to IP blocking or other countermeasures by the site. Expect potential rate limits or blocks if used repeatedly. - If you are unsure about legal or policy implications, consult the MDAC site's terms or local guidance before using an automated bypass. If you want additional assurance, ask for a line-by-line walkthrough of the script or request that the author replace the CAPTCHA bypass with a user-assisted step (prompt the user to solve the slider manually) to avoid automated evasion.

Automates filling and submitting the Malaysia Digital Arrival Card at: https://imigresen-online.imi.gov.my/mdac/main?registerMain

(Use ?registerMain to skip the announcement popup)

Quick Start

python3 skills/mdac-filler/scripts/fill_and_submit.py --data '{
  "name": "JOHN DOE",
  "passNo": "A1234567",
  "nationality": "CHN",
  "pob": "CHN",
  "dob": "01/01/1990",
  "sex": "1",
  "passExpDte": "01/01/2030",
  "email": "[e-mail]",
  "confirmEmail": "[e-mail]",
  "region": "65",
  "mobile": "91234567",
  "arrDt": "25/03/2026",
  "trvlMode": "2",
  "depDt": "25/03/2026",
  "embark": "SGP",
  "vesselNm": "Bus 170",
  "accommodationStay": "99",
  "accommodationAddress1": "106-108, Jalan Wong Ah Fook, Bandar Johor Bahru",
  "accommodationAddress2": "Johor Bahru City Square",
  "accommodationState": "01",
  "accommodationCity": "0118",
  "accommodationPostcode": "80250"
}'

Or use a JSON file:

python3 skills/mdac-filler/scripts/fill_and_submit.py --file traveler.json

CAPTCHA Bypass Strategy

The MDAC uses longbow.slidercaptcha.js. Bypass approach:

1. Patch $.ajax to handle the /captcha verification response
2. Read instance.x (real gap coordinate) via $('.slidercaptcha').data('plugin_sliderCaptcha').x
3. Calculate moveX: instance.x * (width-40) / (width-40-20) where width=271
4. Drag slider with ease-in-out-cubic + slight y-jitter to avoid bot detection

Success condition: sliderContainer_success class appears on container.

Manual JS Fill (browser console)

If using the script is not possible, paste this in the browser console:

(function(data){
  retrieveRefCity(data["accommodationState"]);
  document.getElementById("accommodationState").value=data["accommodationState"];
  setTimeout(function(){
    document.getElementById("accommodationCity").value=data["accommodationCity"];
    retrievePostcode(data["accommodationCity"]);
    for (var key in data){ document.getElementById(key).value=data[key]; }
  }, 1000);
})({ /* traveler data object */ });

Field Values Reference

See references/field-values.md for:

• Country/nationality codes
• Sex, travel mode, accommodation type codes
• State and city codes (Johor focus)
• Common Johor Bahru addresses
• CAPTCHA technical details

Requirements

• Python 3.8+
• pip install playwright && playwright install chromium
• Headless=False (site detects headless browsers)

Notes

• MDAC must be submitted within 3 days before arrival
• Singapore citizens are exempt
• Each traveler needs a separate submission
• Confirmation email sent to provided address after success