54 个 · 按相关度排序
Review public forms for automated abuse protection. Check CAPTCHA, a mechanism for detecting bots, along with hidden trap fields and request limits, then help integrate a CAPTCHA service and validate its tokens on the server.
中文简介正在准备中。当前显示英语简介。
Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N failures (first N requests bypass it). Detection: intercept a successful form submission, remove the CAPTCHA field entirely, replay — if it still succeeds, server-side validation is absent. Medium severity standalone; High when it removes the only rate-limit gate protecting a login, registration, or payment endpoint.
中文简介正在准备中。当前显示原文说明。
1. GET the form/endpoint that shows a CAPTCHA to understand its field name (usually g-recaptcha-response, captcha, captcha_token, captcha_answer, h-captcha-response)
中文简介正在准备中。当前显示原文说明。
Review sign-in, registration, multi-factor authentication, and account recovery for accessibility barriers. Find blocked paste, difficult code entry, and inaccessible backup methods, then suggest authentication paths that support password managers, autofill, or device approval.
中文简介正在准备中。当前显示英语简介。
Extract web page content as Markdown from a single URL or a site crawl. When access is blocked, progressively switch from basic fetching to Chrome and Bright Data proxy services, which route requests through other IP addresses.
中文简介正在准备中。当前显示英语简介。
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
中文简介正在准备中。当前显示原文说明。
Solve CAPTCHAs using 2Captcha service via CLI. Use for bypassing captchas during web automation, account creation, or form submission.
中文简介正在准备中。当前显示原文说明。
The default code-driven browser path for interactive browsing work: drives any browser from code with token-efficient a11y snapshots (57% smaller via compactSnapshot), ref-based clicks, coordinate control (CUA), viewport pinning, CAPTCHA solving (reCAPTCHA, Turnstile, hCaptcha, slider, OCR), Chrome MV3 APIs (tabs/bookmarks/history/downloads/topSites), network snoop (read API JSON instead of DOM), flight-recorder trace (jsonl + HAR + screenshots), OOPIF-aware snapshots, dialog policy, human handoff for login/OTP, device emulation, request routes, stealth via CloakBrowser as the default owned engine with zero exposed CDP ports, and an attached engine that drives the user's own signed-in browser through BrowserSkill (connectBrowserSkill, bskSnapshot, one-click onboarding via bskOnboard). MUST USE for interactive browser work: scraping, blocked/WAF/JS-rendered pages, logins, the user's logged-in sites and open tabs, extension popups, form filling, screenshots, web QA, CAPTCHAs. The ulw-research browsing lane runs on ultimate-browsing, not this skill.
中文简介正在准备中。当前显示原文说明。
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
中文简介正在准备中。当前显示原文说明。
Solve captchas using 2captcha service
中文简介正在准备中。当前显示原文说明。
Computer Use Agent — autonomous browser control via Steel, Browser Use, and Browserbase cloud providers. Supports headful CDP sessions, CAPTCHA solving, proxy rotation, live view, session recording/replay, Playwright/Puppeteer integration, and LLM-driven visual browsing. Use when asked about computer use, browser automation, web scraping, Steel sessions, cloud browsers, headful browsing, CAPTCHA solving, or autonomous web navigation.
中文简介正在准备中。当前显示原文说明。
Solve CAPTCHAs with 2Captcha from the command line during browser automation.
中文简介正在准备中。当前显示原文说明。
Human-in-the-loop CAPTCHA solving with two modes: screenshot (default, zero infrastructure) and token relay (requires network access). Screenshot mode captures the page with a grid overlay, sends it to the human, and injects clicks based on their reply. Token relay mode detects CAPTCHA type + sitekey, serves the real widget on a relay page for native solving, and injects the token via CDP.
中文简介正在准备中。当前显示原文说明。
Helps you integrate hosted browser automation through Browser Use Cloud APIs and Python or TypeScript SDKs. Reference guides cover authentication, sessions, saved browser profiles, live views, and connections to existing agents or workflow services.
中文简介正在准备中。当前显示英语简介。
Save web content as readable Markdown, a plain-text format for structured notes. Supports X posts, YouTube transcripts, Hacker News discussions, and general pages, with optional local downloads of images and videos.
中文简介正在准备中。当前显示英语简介。
Bring up a REAL, visible, interactive chromium on the Kali VM that the operator logs into (Smart-ID / Mobile-ID / any manual auth or MFA/CAPTCHA), while the agent drives and observes it live through the chrome-devtools MCP (navigate, DOM snapshot, network capture, screenshots, console, evaluate). Use whenever a target needs a MANUAL login the agent cannot complete headlessly, when you need to capture an authenticated session / the real API calls a page makes, or to confirm/screenshot a DOM-XSS. Triggers - "open a browser", "log in manually", "smart-id / mobile-id / national id login", "mfa / 2fa login", "solve the captcha", "drive the browser", "capture the authenticated session / network".
中文简介正在准备中。当前显示原文说明。
This skill should be used when the user asks to "add turnstile", "implement bot protection", "validate turnstile token", "fix turnstile error", "setup captcha alternative", or encounters error codes 100*/300*/600*, CSP errors, or token validation failures. Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono.
中文简介正在准备中。当前显示原文说明。
Anti-detection behaviour for Genesis browser automation - what the Camoufox tools already do, what the agent must still do, Cloudflare Turnstile handling, and per-site notes for bot-hostile sites
中文简介正在准备中。当前显示原文说明。
Cloudflare Turnstileをprojectへend-to-endで導入する。codebaseを調査し、Cloudflare APIでwidgetを作成し、適切なformへ埋め込み、既存backendへ正式なserver-side siteverifyを接続して検証する。Turnstile追加、CAPTCHA設定、botからのform保護、Turnstile連携修正を依頼されたときに使用する。developers.cloudflare.com/turnstile/spinの中核手順へAIDD固有の安全規則を重ねたSkill。
中文简介正在准备中。当前显示原文说明。
使用OpenClaw的browser工具完成多步骤网页操作，先检查登录状态与标签页，再读取页面并操作；同时处理失效的操作目标引用和超时问题。
将网站通信记录为HAR文件，分析获取JSON所用的API并构建HTTP客户端，以便无需浏览器即可重复搜索或获取相同数据。
Guides setup for paying for Browser Use Cloud tasks with USDC on Base, a blockchain network. Covers wallet preparation, private key storage, a paid test, and SDK integration, including use without signup or an API key.
中文简介正在准备中。当前显示英语简介。
Fill web forms from a JSON list of field names and values, using saved templates or page labels to locate inputs. Optionally submit the form, save new field mappings, and redact values from recorded actions.
中文简介正在准备中。当前显示英语简介。
Automate forms, clicks, screenshots, and website checks in a browser where you are already signed in. A separately launched browser also supports scraping and network capture, while login or verification steps can be handed to a person.
中文简介正在准备中。当前显示英语简介。