captcha-bypass
Fail
Audited by Snyk on Mar 11, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes code/config examples that require inserting API keys and proxy credentials (e.g., CAPTCHA_API_KEY, capsolver.api_key, proxy username/password) directly into requests or scripts, which would force the LLM to handle/output secret values verbatim.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly requires using a browser tool to navigate Cloudflare/target websites and to submit site URLs/site-keys to third-party CAPTCHA solvers (e.g., the "Step 2: Use the Browser Tool" section and the 2Captcha/CapSolver examples), which means the agent will fetch and interpret arbitrary public web content that can influence its subsequent actions.
Audit Metadata