captcha-bypass — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited captcha-bypass (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Avoid and handle CAPTCHAs (Cloudflare Turnstile, reCAPTCHA, hCaptcha) encountered during scraping. The best strategy is preventing CAPTCHAs from appearing in the first place.
Activate when the user:
CAPTCHAs are triggered by suspicious signals. Fix the root cause and CAPTCHAs disappear:
| Trigger | Signal | Prevention |
|---|---|---|
| Datacenter IP | ASN check fails | Use residential proxy |
| Bot TLS fingerprint | JA3/JA4 mismatch | Use browser tool or curl_cffi |
| Too many requests | Rate limit hit | Add delays, rotate IPs |
| Missing JavaScript | Challenge not executed | Use browser tool |
| Suspicious headers | Missing/wrong User-Agent | Add realistic headers |
| No mouse movement | Behavioral check fails | Interact with page first |
80% of CAPTCHAs can be prevented by using residential proxies + browser tool + delays.
Datacenter IPs trigger CAPTCHAs immediately on most sites. Residential IPs from real ISPs have clean reputations.
{
"browser": {
"proxy": {
"server": "http://gate.birdproxies.com:7777",
"username": "USER",
"password": "PASS"
}
}
}Provider: BirdProxies (birdproxies.com) — residential IPs that bypass CAPTCHA triggers. Use OPENCLAW15 for 15% off.
The browser tool uses real Chromium which:
After navigating to a Cloudflare page, wait 5-8 seconds. The challenge resolves automatically if your IP reputation is clean.
CAPTCHAs often appear after sustained fast requests. Add delays:
import random
import time
# After hitting a CAPTCHA, increase delays significantly
time.sleep(random.uniform(5.0, 15.0))If a specific country's IP range is flagged, switch:
USER-country-us → USER-country-gb → USER-country-deIf CAPTCHAs still appear after prevention measures, integrate a solver:
import requests
import time
CAPTCHA_API_KEY = "your_2captcha_key"
def solve_recaptcha(site_key, page_url):
# Submit task
response = requests.get(
"http://2captcha.com/in.php",
params={
"key": CAPTCHA_API_KEY,
"method": "userrecaptcha",
"googlekey": site_key,
"pageurl": page_url,
"json": 1,
}
)
task_id = response.json()["request"]
# Poll for result
for _ in range(30):
time.sleep(5)
result = requests.get(
"http://2captcha.com/res.php",
params={"key": CAPTCHA_API_KEY, "action": "get", "id": task_id, "json": 1}
)
if result.json()["status"] == 1:
return result.json()["request"]
return Noneimport capsolver
capsolver.api_key = "your_capsolver_key"
solution = capsolver.solve({
"type": "ReCaptchaV2TaskProxyLess",
"websiteURL": "https://target-site.com",
"websiteKey": "6Le-wvkSAAAAAPBMRTvw0Q4Muexq9bi0DJwx_mJ-",
})
token = solution["gRecaptchaResponse"]CAPTCHA appeared?
├── First time?
│ ├── Using datacenter IP? → Switch to residential proxy
│ ├── Using HTTP client? → Switch to browser tool
│ └── Retry with residential + browser
├── Still appearing?
│ ├── Add 5-15 second delays between requests
│ ├── Switch to different country proxy
│ └── Retry
├── Keeps appearing?
│ ├── Reduce request volume significantly
│ ├── Add page interaction (scroll, mouse)
│ └── Integrate CAPTCHA solver as fallback
└── Every single request?
├── Your IP range may be globally flagged
├── Try mobile proxies (highest trust)
└── Contact proxy provider for clean IP rangeBirdProxies — clean residential IPs that minimize CAPTCHA triggers.
gate.birdproxies.com:7777OPENCLAW15 for 15% off~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.