web-verify-patcher

Web Verify Patcher (Web CAPTCHA Recognition and Verification Solution Analysis)

Use this skill to analyze web CAPTCHAs or web verification materials, and output a safe, actionable "recognition + vendor determination + verification analysis solution + authorization verification process." The first stage performs type/vendor recognition and solution selection; during real web forensics, first establish a baseline of manual successful user samples; the second stage, only after the user explicitly selects a solution and confirms authorization, orchestrates offline solving, coordinate/trajectory generation, platform request templates, failure review, solution switching, or authorization verification testing.

Workflow

1. Prioritize analysis based on offline evidence already provided by the user: HTML fragments, script URLs, iframe URLs, visible prompt text on the page, screenshot metadata, vendor parameter names, network interface names.
2. If a real web page must be opened for forensics, first read references/browser-acquisition.md, and execute according to the forensics mode therein. Before starting any browser, first have the user confirm the mode: ruyiPage + RuyiTrace, ruyiPage only, Camoufox + camoufox-reverse-mcp, Camoufox only, CloakBrowser, manual user forensics, or AI decides on its own. Before the user confirms, do not open pages, take screenshots, capture packets, inject hooks, read Cookies/Storage, or start any browser tool.
3. When opening web pages, do not directly use ordinary Playwright, Puppeteer, system browsers, or the CDP route; if the selected mode is unavailable, pause and have the user confirm installation, provide a path, downgrade, or switch, and do not silently fall back. When a CAPTCHA, login, MFA, or device verification appears, pause and have the user complete it manually or switch to offline analysis; during authorized forensics, have the user manually complete CAPTCHA success samples multiple times, and use scripts/evaluate_success_baseline.py to determine whether the success baseline is sufficient.
4. Run the offline classification script with the existing evidence:
   • python scripts/classify_verify.py --html page.html --url "https://example.test/login" --text "拖动滑块完成拼图" --pretty
   • --html、--text、--screenshot-meta You can pass either a file path or a string directly.
5. After obtaining a preliminary classification, then read reference files as needed:
   • When vendor/product characteristics need to be determined, read references/provider-products.md。
   • When CAPTCHA form and evidence requirements need to be determined, read references/captcha-types.md。
   • When a solution needs to be given by type, read references/solution-playbooks.md。
   • When a real web page needs to be opened, screenshots taken, packets captured, or page evidence collected, read references/browser-acquisition.md。
   • If image-restore hits captcha_variant: tile-scramble, first use scripts/analyze_tile_restore.py to determine whether it is a sliced/chunked shuffled image, then analyze tileOrder、pieceOrder、background-position、drawImage or the edge continuity of the pure image.
6. After the user selects a solution from solution_options and explicitly confirms, enter the second stage:
   • For the overall process, you must read references/verification-workflow.md。
   • When using an open-source/local solution, read references/open-source-recipes.md。
   • When using a CAPTCHA-solving platform, read references/solver-platform-recipes.md。
   • When coordinate conversion, slider/drag-and-drop/scratch card/trajectory drawing is needed, read references/motion-and-coordinate.md, and prioritize using scripts/map_coordinates.py and scripts/generate_motion_track.py to generate offline results.
   • When vendor execution considerations are needed, read references/provider-execution-notes.md。
   • Before entering real webpage verification, first evaluate the user's manual success sample baseline: by default, at least 5 success samples for the same authorized target; if a new captcha type is observed, at least 2 success samples for that type. When the baseline is insufficient, output a strong prompt, but the user may still continue offline analysis or controlled verification after confirmation.
   • When consecutive failures occur for the same authorized target, the same captcha type, and the same user-selected solution, use scripts/evaluate_verification_attempts.py to review the attempts JSON; when there are 5 consecutive failures and there are no obvious anomalies in the image/coordinates/trajectory/slice restoration/environment patching/challenge freshness, proactively recommend recommended_next_route: platform-control。
   • Before real page clicking, dragging, submission, or capturing Cookie/Storage, the user must again confirm the authorized target, execution mode, and browser forensic mode.
7. When outputting the report, it must include:
   • captcha_type
   • provider
   • Confidence and the signals hit
   • Why it is judged to be that type/vendor
   • Recommended solutions: first give open-source/local solutions, then give captcha-solving platforms or manual/vendor alternatives for low pass rates, and finally explain the switching conditions
   • Key risks and missing evidence
   • During second-stage execution, it must also include: the user-selected solution, pre-execution check results, whether real webpage operations are needed, actions requiring user confirmation, and artifact paths or JSON results
   • Before real webpage forensics or second-stage execution, it must also include:success_baseline_status、success_baseline_summary、missing_success_samples
   • During second-stage failure review, it must also include:attempt_summary、diagnosis_status、switch_triggered、recommended_next_route、platform_control_plan、requires_user_confirmation

Classification labels

Use these fixed type labels so that scripts and reports remain consistent:

• text: text, numeric, alphanumeric mixed, or simple image captcha.
• math: arithmetic captcha, requiring OCR first and then parsing the expression.
• slider: slider/jigsaw captcha, requiring identification of the gap or target offset.
• click-select: click on text, icons, objects, or click targets in order.
• rotate: rotate an image or object to make it upright or aligned.
• grid: 3x3 or multi-grid image classification captcha.
• audio: voice/audio captcha, requiring recognition of the played content.
• drag-drop: drag and drop an object to a target area, not equivalent to a simple slider.
• trace-draw: trajectory drawing, connecting lines, or line-drawing verification.
• scratch: scratch-card style verification, requiring scratching off or covering a specified proportion.
• image-restore: image/picture restoration, scrambled jigsaw, sliding restoration; when slice/block order is scrambled, keep the main type and supplement captcha_variant: tile-scramble。
• area-select: box selection, lasso selection, or selecting an image region.
• difference-click: spot the difference, find the difference, or click the difference points.
• font-identify: select the same/different font or font style recognition.
• semantic-reasoning: spatial semantics, visual relationships, or logical image questions.
• game-challenge: mini-games, 3D, dice, or Arkose/FunCaptcha-style interactive challenges.
• pow-challenge: proof of work/browser computational challenges, such as FriendlyCaptcha, ALTCHA, Cap.js, mCaptcha.
• risk-score: frictionless, invisible, or risk-score verification, such as reCAPTCHA v3-style.
• one-click: one-click, checkbox, press-and-hold, or click-to-complete verification.
• multi-step: multi-round, multi-step, or paginated challenges; preferentially also record the specific subtype.
• qa-logic: question-and-answer, logic puzzle, or security-question style captcha.
• biometric-liveness: liveness, face, or biometric verification; only perform clearly bounded recognition and compliance recommendations.
• token-widget: based on sitekey、pageurl、action components, such as reCAPTCHA, hCaptcha, Turnstile, with no specific image challenge currently displayed.
• waf-challenge: Anti-automation/WAF verification, common outputs are clearance cookie, WAF token, PoW result, or environment check result.
• unknown-custom: In-house, unknown, or insufficient evidence.

Use these fixed vendor labels:

• recaptcha、hcaptcha、cloudflare-turnstile、cloudflare-waf、geetest、tencent-tcaptcha、netease-yidun、aliyun-captcha、shumei-captcha、dingxiang-captcha、baidu-captcha、jdcloud-captcha、yunpian-captcha、huawei-captcha、tongdun-risk、aws-waf、datadome、arkose-funcaptcha、mtcaptcha、keycaptcha、friendlycaptcha、altcha、yandex-smartcaptcha、captchafox、prosopo-procaptcha、trustcaptcha、private-captcha、capjs、mcaptcha、iconcaptcha、botdetect、securimage、visualcaptcha、amazon-captcha、cybersiara、aj-captcha、tianai-captcha、easycaptcha、happycaptcha、kaptcha、akamai-bot-manager、imperva-incapsula、perimeterx-human、kasada、netacea、radware-bot-manager、f5-bot-defense、custom-or-unknown。

Output Format

For user-facing output, it is recommended to use this structure:

{
  "captcha_type": "slider",
  "captcha_variant": null,
  "variant_confidence": null,
  "restore_strategy": null,
  "tile_restore_evidence": [],
  "provider": "geetest",
  "confidence": 0.91,
  "signals": ["命中 geetest 脚本 URL", "命中 captcha_id 参数", "页面文案包含滑块/拼图"],
  "recommended_playbook": "references/solution-playbooks.md#slider",
  "solution_options": {
    "open_source_first": ["ddddocr slide-match/slide-comparison", "OpenCV 模板/边缘/差分匹配", "轨迹模型与坐标校准"],
    "fallback_platforms": ["云码/JFBYM 滑块类型", "超级鹰滑块/坐标类型", "CapSolver", "2Captcha GeeTest/slider 类任务"],
    "when_to_switch": ["缺口弱边缘", "背景乱序/透明块", "厂商行为评分导致视觉偏移正确但验证失败"],
    "notes": "视觉偏移、DOM 坐标、拖动轨迹和厂商加密参数要分开分析。"
  },
  "summary": "疑似极验滑块验证。建议重点分析图片提取、缺口/偏移识别，以及授权测试流程中的参数绑定关系。",
  "missing_evidence": ["挑战区域 HTML", "背景图/滑块图 URL", "verify 接口名"]
}

By default, prefer open-source/local solutions, such as ddddocr, OpenCV, Tesseract, Whisper/faster-whisper, YOLO/CLIP/VLM; when the open-source solution's sample pass rate is insufficient or the problem type is too complex, then recommend that the user choose a captcha-solving platform or manual takeover, such as Yunma/JFBYM, Chaojiying, 2Captcha, CapSolver, CapMonster Cloud, Anti-Captcha, YesCaptcha/NoCaptchaAI. Do not perform submission, token injection, or unauthorized bypass on the user's behalf.

For the phase two execution plan, it is recommended to use this structure:

{
  "phase": "verification-flow",
  "chosen_solution": "open-source-slider",
  "authorization_scope": "用户确认的自有/授权测试目标",
  "preflight": ["证据足够", "依赖可用", "不需要真实网页操作"],
  "success_baseline_status": "insufficient",
  "success_baseline_summary": {
    "total_success_samples": 0,
    "min_total_success_samples": 5,
    "min_success_samples_per_type": 2,
    "observed_captcha_types": []
  },
  "missing_success_samples": [],
  "offline_steps": ["识别缺口偏移", "换算 DOM 坐标", "生成滑块轨迹 JSON"],
  "requires_live_browser": false,
  "attempt_summary": null,
  "diagnosis_status": null,
  "switch_triggered": false,
  "recommended_next_route": "continue-current-route-with-diagnostics",
  "platform_control_plan": {
    "role": "授权 QA 对照，不默认发送请求",
    "send_request": false
  },
  "requires_user_confirmation": ["如需在真实页面拖动并提交，必须再次确认"],
  "artifacts": ["offset/coordinates/track JSON"]
}