50 skills · sorted by relevance
Review public forms for automated abuse protection. Check CAPTCHA, a mechanism for detecting bots, along with hidden trap fields and request limits, then help integrate a CAPTCHA service and validate its tokens on the server.
Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N failures (first N requests bypass it). Detection: intercept a successful form submission, remove the CAPTCHA field entirely, replay — if it still succeeds, server-side validation is absent. Medium severity standalone; High when it removes the only rate-limit gate protecting a login, registration, or payment endpoint.
The English summary is being prepared. Showing the original description.
1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually g-recaptcha-response, captcha, captcha_token, captcha_answer, h-captcha-response)
The English summary is being prepared. Showing the original description.
Review sign-in, registration, multi-factor authentication, and account recovery for accessibility barriers. Find blocked paste, difficult code entry, and inaccessible backup methods, then suggest authentication paths that support password managers, autofill, or device approval.
Extract web page content as Markdown from a single URL or a site crawl. When access is blocked, progressively switch from basic fetching to Chrome and Bright Data proxy services, which route requests through other IP addresses.
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
The English summary is being prepared. Showing the original description.
Solve CAPTCHAs using 2Captcha service via CLI. Use for bypassing captchas during web automation, account creation, or form submission.
The English summary is being prepared. Showing the original description.
The default code-driven browser path for interactive browsing work: drives any browser from code with token-efficient a11y snapshots (57% smaller via compactSnapshot), ref-based clicks, coordinate control (CUA), viewport pinning, CAPTCHA solving (reCAPTCHA, Turnstile, hCaptcha, slider, OCR), Chrome MV3 APIs (tabs/bookmarks/history/downloads/topSites), network snoop (read API JSON instead of DOM), flight-recorder trace (jsonl + HAR + screenshots), OOPIF-aware snapshots, dialog policy, human handoff for login/OTP, device emulation, request routes, stealth via CloakBrowser as the default owned engine with zero exposed CDP ports, and an attached engine that drives the user's own signed-in browser through BrowserSkill (connectBrowserSkill, bskSnapshot, one-click onboarding via bskOnboard). MUST USE for interactive browser work: scraping, blocked/WAF/JS-rendered pages, logins, the user's logged-in sites and open tabs, extension popups, form filling, screenshots, web QA, CAPTCHAs. The ulw-research browsing lane runs on ultimate-browsing, not this skill.
The English summary is being prepared. Showing the original description.
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
The English summary is being prepared. Showing the original description.
Solve captchas using 2captcha service
The English summary is being prepared. Showing the original description.
Computer Use Agent — autonomous browser control via Steel, Browser Use, and Browserbase cloud providers. Supports headful CDP sessions, CAPTCHA solving, proxy rotation, live view, session recording/replay, Playwright/Puppeteer integration, and LLM-driven visual browsing. Use when asked about computer use, browser automation, web scraping, Steel sessions, cloud browsers, headful browsing, CAPTCHA solving, or autonomous web navigation.
The English summary is being prepared. Showing the original description.
Solve CAPTCHAs with 2Captcha from the command line during browser automation.
The English summary is being prepared. Showing the original description.
Human-in-the-loop CAPTCHA solving with two modes: screenshot (default, zero infrastructure) and token relay (requires network access). Screenshot mode captures the page with a grid overlay, sends it to the human, and injects clicks based on their reply. Token relay mode detects CAPTCHA type + sitekey, serves the real widget on a relay page for native solving, and injects the token via CDP.
The English summary is being prepared. Showing the original description.
Helps you integrate hosted browser automation through Browser Use Cloud APIs and Python or TypeScript SDKs. Reference guides cover authentication, sessions, saved browser profiles, live views, and connections to existing agents or workflow services.
Save web content as readable Markdown, a plain-text format for structured notes. Supports X posts, YouTube transcripts, Hacker News discussions, and general pages, with optional local downloads of images and videos.
Bring up a REAL, visible, interactive chromium on the Kali VM that the operator logs into (Smart-ID / Mobile-ID / any manual auth or MFA/CAPTCHA), while the agent drives and observes it live through the chrome-devtools MCP (navigate, DOM snapshot, network capture, screenshots, console, evaluate). Use whenever a target needs a MANUAL login the agent cannot complete headlessly, when you need to capture an authenticated session / the real API calls a page makes, or to confirm/screenshot a DOM-XSS. Triggers - "open a browser", "log in manually", "smart-id / mobile-id / national id login", "mfa / 2fa login", "solve the captcha", "drive the browser", "capture the authenticated session / network".
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "add turnstile", "implement bot protection", "validate turnstile token", "fix turnstile error", "setup captcha alternative", or encounters error codes 100*/300*/600*, CSP errors, or token validation failures. Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono.
The English summary is being prepared. Showing the original description.
Anti-detection behaviour for Genesis browser automation - what the Camoufox tools already do, what the agent must still do, Cloudflare Turnstile handling, and per-site notes for bot-hostile sites
The English summary is being prepared. Showing the original description.
Cloudflare Turnstileをprojectへend-to-endで導入する。codebaseを調査し、Cloudflare APIでwidgetを作成し、適切なformへ埋め込み、既存backendへ正式なserver-side siteverifyを接続して検証する。Turnstile追加、CAPTCHA設定、botからのform保護、Turnstile連携修正を依頼されたときに使用する。developers.cloudflare.com/turnstile/spinの中核手順へAIDD固有の安全規則を重ねたSkill。
The English summary is being prepared. Showing the original description.
Guides multi-step web tasks with the OpenClaw browser tool, including login checks, tab reuse, and page inspection before actions. It also covers recovery when element references expire or browser operations time out.
Record a website's network traffic in a HAR file, a log of requests and responses, then derive an HTTP client from its JSON requests. Reuse captured request details to run searches or fetch data without repeated browser interaction.
Guides setup for paying for Browser Use Cloud tasks with USDC on Base, a blockchain network. Covers wallet preparation, private key storage, a paid test, and SDK integration, including use without signup or an API key.
Fill web forms from a JSON list of field names and values, using saved templates or page labels to locate inputs. Optionally submit the form, save new field mappings, and redact values from recorded actions.
Automate forms, clicks, screenshots, and website checks in a browser where you are already signed in. A separately launched browser also supports scraping and network capture, while login or verification steps can be handed to a person.