captcha-base-skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:44 AM UTC
• Version: 1.0.10

Overview

The skill is coherent but needs Review because it can send captcha images, challenge details, and a JFBYM token to a third-party paid solver, including ReCAPTCHA and hCaptcha token workflows.

Install only if you are comfortable with captcha data and challenge metadata being sent to JFBYM when cloud mode or automatic fallback is used. Keep JFBYM_TOKEN unset for local-only use, avoid full-page or sensitive screenshots, use an isolated environment, and upgrade pinned dependencies before processing untrusted images.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior goes beyond a simple local captcha utility: it supports sending captcha images and tokens to a third-party service, querying account balance, refund operations, and token-based cloud solving including ReCAPTCHA/hCaptcha flows. This mismatch is dangerous because users or orchestrating agents may trust the 'local-first/basic' framing and pass sensitive screenshots or secrets into a skill that can transmit them externally, especially in browser automation and RPA contexts where screenshots often contain adjacent sensitive data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: Pillow==10.4.0 — 16 advisory(ies): CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`); CVE-2026-55798 (Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pat); CVE-2026-54060 (Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_) +13 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The file pins Pillow to 10.4.0 despite numerous advisories, including image parsing and command-execution related issues. This skill processes captcha images, so a vulnerable image library is especially relevant because untrusted or malformed images are part of the normal input surface, increasing the chance that a parsing flaw, decompression bomb bypass, or platform-specific command injection path could be exploited.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and documents access to environment variables and outbound network communication, but it does not declare any explicit tool scope or permissions boundary. In agent ecosystems, missing scope declarations can cause operators or upstream agents to invoke the skill without realizing it can exfiltrate image data and use a token from the environment, increasing the risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The paid fallback paths invoke remote SDK methods that transmit user-supplied captcha images and related data to an external service, but this file provides no explicit user-facing notice, consent gate, or data-handling warning at the CLI/API boundary. In a captcha-solving skill, this is especially sensitive because images may contain account, session, or anti-bot challenge data from third-party sites, creating privacy, compliance, and misuse risks when silently exfiltrated off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jfbym_api.py (reported line 23)May include surrounding context.

python

def __init__(
        self,
        token: Optional[str] = None,
        base_url: str = "https://api.jfbym.com/api/YmServer",
    ):
        self.token = token or os.environ.get("JFBYM_TOKEN")
        self.skill_channel_developer_tag = self.SKILL_CHANNEL_DEVELOPER_TAG

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jfbym_sdk.py (reported line 17)May include surrounding context.

python

def __init__(
        self,
        token: Optional[str] = None,
        base_url: str = "https://api.jfbym.com/api/YmServer",
    ):
        self.token = token or os.environ.get("JFBYM_TOKEN")
        self.skill_channel_developer_tag = self.SKILL_CHANNEL_DEVELOPER_TAG

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This function sends the service token to an external endpoint. Although expected for a cloud API client, it is still an external transmission of a credential, and compromise or misuse of the configured endpoint could expose account access or billing state.

Content

Scanner excerpt · jfbym_sdk.py (reported line 44)May include surrounding context.

python

def get_balance(self) -> str:
        url = f"{self.base_url}/getUserInfoApi"
        res = requests.post(
            url,
            json={"token": self._require_token(), "type": "score"},
            headers=self._headers,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The SDK transmits sensitive material including account token and, elsewhere in the file, CAPTCHA images/page metadata to an external cloud service without any built-in disclosure, consent prompt, or privacy guardrails. In a skill intended for automation, this increases the chance that operators unknowingly send user data, screenshots, or protected page details to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This request transmits the service token and a unique code to an external API. That is normal for refund/report workflows, but it still constitutes sensitive outbound data flow to a third party and can be abused if the destination is altered or requests are logged insecurely.

Content

Scanner excerpt · jfbym_sdk.py (reported line 55)May include surrounding context.

python

def report_error(self, unique_code: str) -> bool:
        url = f"{self.base_url}/refundApi"
        res = requests.post(
            url,
            json={"token": self._require_token(), "uniqueCode": unique_code},
            headers=self._headers,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This call uploads token plus CAPTCHA content and arbitrary extra/kwargs data to a remote service. In automation workflows, those images or metadata may include sensitive user content or challenge material from third-party sites, making the external transmission materially risky if used without consent or scope restriction.

Content

Scanner excerpt · jfbym_sdk.py (reported line 82)May include surrounding context.

python

payload.update(kwargs)

        url = f"{self.base_url}/customApi"
        res = requests.post(url, json=payload, headers=self._headers).json()
        if res.get("code") == 10000:
            return res["data"]
        raise Exception(f"打码失败: {res}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This method sends slide and background images, along with the account token, to an external solver. Because screenshots and background images can reveal session state or page content, this is a high-risk data transfer in browser automation contexts.

Content

Scanner excerpt · jfbym_sdk.py (reported line 108)May include surrounding context.

python

payload.update(kwargs)

        url = f"{self.base_url}/customApi"
        res = requests.post(url, json=payload, headers=self._headers).json()
        if res.get("code") == 10000:
            return res["data"]
        raise Exception(f"滑块打码失败: {res}")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes solve_recaptcha, which brokers ReCAPTCHA solving through a third-party service and returns a usable token. That materially expands capability from basic image CAPTCHA recognition into anti-bot challenge bypass, which is higher risk in browser automation/RPA contexts because it can be used to evade access controls and abuse protected services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This creates a remote ReCAPTCHA-solving task and sends pageurl, site key, and related anti-bot challenge metadata to a third-party service. In context, that is more dangerous than ordinary OCR because it supports bypass of anti-abuse controls on external services.

Content

Scanner excerpt · jfbym_sdk.py (reported line 130)May include surrounding context.

python

payload["action"] = kwargs.get("action", "")
            payload["min_score"] = kwargs.get("min_score", "0.8")

        res = requests.post(create_url, json=payload, headers=self._headers).json()
        if res.get("code") != 10000:
            raise Exception(f"创建 ReCAPTCHA 任务失败: {res}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

This polling request sends task identifiers and token back to the provider to retrieve a ReCAPTCHA result. While routine for the API, it continues the high-risk external workflow tied to anti-bot token acquisition and exposes operational metadata to the third party.

Content

Scanner excerpt · jfbym_sdk.py (reported line 146)May include surrounding context.

python

for _ in range(24):
            time.sleep(5)
            poll_res = requests.post(
                result_url, json=result_payload, headers=self._headers
            ).json()
            if poll_res.get("code") == 10001:

Tainted flow: 'result_payload' from requests.post (line 138, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · jfbym_sdk.py (reported line 146)May include surrounding context.

python

for _ in range(24):
            time.sleep(5)
            poll_res = requests.post(
                result_url, json=result_payload, headers=self._headers
            ).json()
            if poll_res.get("code") == 10001:

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The file pins requests to 2.31.0, which is flagged by multiple advisories, including issues involving .netrc credential leakage and TLS/session verification problems. In a captcha skill that may fetch remote images or interact with third-party services, an outdated HTTP client increases risk of credential exposure, insecure request handling, or other network-layer weaknesses if vulnerable code paths are exercised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The constructor reads the sensitive environment variable JFBYM_TOKEN, but the code provides no comment, docstring, or user-facing notice that credentials may be sourced from the environment. Access to credentials is in scope for missing-warning findings when no disclosure is present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The class docstring is written only in Chinese ("本地免费验证码能力。"), which indicates a language-specific user-facing description without offering any locale choice or documenting a justified regional constraint. The policy for natural-language violations applies to all file types and flags forced language/locale behavior when there is no opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.