CtrlK
BlogDocsLog inGet started
Tessl Logo

hunt-captcha-bypass

Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA token replayed from a solved challenge (no single-use enforcement), (3) CAPTCHA response accepted on a different endpoint than it was solved on (no binding to action/session), (4) static or predictable CAPTCHA values accepted (e.g. '0', 'null', empty string), (5) audio/accessibility CAPTCHA trivially solvable programmatically, (6) CAPTCHA only enforced after N failures (first N requests bypass it). Detection: intercept a successful form submission, remove the CAPTCHA field entirely, replay — if it still succeeds, server-side validation is absent. Medium severity standalone; High when it removes the only rate-limit gate protecting a login, registration, or payment endpoint.

67

Quality

80%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/hunt-captcha-bypass/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

An actionable, well-sequenced security-testing skill body with concrete steps and verification checkpoints. Its weaknesses are mild redundancy between the testing-priority and vulnerability-class sections and a lack of any progressive split into reference files.

Suggestions

Merge or cross-reference the 'Vulnerability Classes' section with 'Autonomous Testing Priority' to remove the duplicated pattern explanations.

Tighten the Pattern 5 sliding-window timing note into a short imperative rule (fire N concurrent well-formed requests) to cut tokens.

Consider moving the per-pattern detail into a references/ file so SKILL.md stays a lean overview with one-level-deep pointers.

DimensionReasoningScore

Conciseness

Mostly efficient and action-oriented, but the 'Vulnerability Classes in This Skill' section re-explains patterns already covered in 'Autonomous Testing Priority' and the Pattern 5 timing note is a padded paragraph, so it could be tightened rather than fully lean.

2 / 3

Actionability

Provides concrete field names ('g-recaptcha-response', 'captcha_token'), numbered executable steps, and a real payload example ('captcha=&email=test@example.com&password=test123'), meeting the copy-paste-ready anchor.

3 / 3

Workflow Clarity

Each pattern is a clearly sequenced numbered list with explicit success conditions ('If the action succeeds (200, redirect...)') and 'Proof:' verification checkpoints, satisfying the explicit-validation anchor.

3 / 3

Progressive Disclosure

Sections are well-organized, but the body is a >50-line monolithic single file with no external references and no content split, so it sits at the 'some structure, content that could be separate is inline' anchor rather than the split-with-references anchor.

2 / 3

Total

10

/

12

Passed

Description

82%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, well-scoped description that lists concrete bypass patterns and a detection method. Its only real gap is the absence of an explicit 'Use when...' trigger clause, which caps completeness.

Suggestions

Add an explicit 'Use when...' clause (e.g. 'Use when testing login, registration, or password-reset endpoints for CAPTCHA enforcement or when the user asks about CAPTCHA bypass').

Trim the inline detection paragraph from the description and keep it in the body to reduce description length without losing the trigger terms.

DimensionReasoningScore

Specificity

Enumerates six concrete bypass patterns (e.g. 'CAPTCHA field simply omitted', 'token replayed from a solved challenge') plus a concrete detection procedure, matching the multiple-specific-actions anchor rather than the single-domain anchor at 2.

3 / 3

Completeness

It clearly answers 'what' (six patterns + detection) but never gives an explicit 'Use when...' trigger clause, so per the guideline a missing explicit trigger caps completeness at 2 rather than 3.

2 / 3

Trigger Term Quality

Uses natural terms a user would actually say — 'Hunt CAPTCHA Bypass', 'CAPTCHA', 'rate-limit gate' — giving good coverage rather than only technical jargon; not reduced to 2 because the common variations ('CAPTCHA bypass') are present.

3 / 3

Distinctiveness Conflict Risk

The CAPTCHA-bypass niche is narrow with distinct triggers and a severity-chaining qualifier, making it unlikely to fire for unrelated skills; matches the clear-niche anchor.

3 / 3

Total

11

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.