Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/suxrobgm/jobpilot/solve-captchanpx skills add suxrobGM/jobpilot --skill solve-captchagit clone --depth 1 https://github.com/suxrobGM/jobpilotWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/suxrobgm/jobpilot/solve-captcha)<a href="https://agentmods.dev/skills/suxrobgm/jobpilot/solve-captcha"><img src="https://agentmods.dev/badge/skills/suxrobgm/jobpilot/solve-captcha.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.01040 |
| Opus 5 | $0.00020 | $0.00520 |
| Sonnet 5 | $0.00008 | $0.00208 |
| Haiku 4.5 | $0.00004 | $0.00104 |
Grade A, and why
solve-captcha scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
RESP=$(curl -fsS -H "authorization: Bearer $JOBPILOT_API_TOKEN" -X POST "$JOBPILOT_API/api/captcha/solve" -H 'content-type: application/json' \ How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Solve CAPTCHA
Clear a CAPTCHA on the current browser tab. Return solved or unsolved (the caller falls back). Authorized use only - the user's own applications. $JOBPILOT_API / $JOBPILOT_API_TOKEN are injected by the terminal host.
1. Dispatch + identify
If the argument is a URL → browser_navigate there first. browser_resize to a tall viewport (1280×1400) so the widget is fully on-screen, then browser_snapshot + browser_take_screenshot the captcha and classify:
- checkbox (reCAPTCHA "I'm not a robot" / hCaptcha / Turnstile) → §2. Always try this first - it escalates to the service only if it opens an image challenge.
- text (distorted characters + answer field) → §3.
- image-grid already open (no checkbox to click) → §4 directly.
- slider / unknown → unsolved.
2. Checkbox (free, first)
browser_click the control by ref, browser_wait_for, re-snapshot. Verified → solved. An image grid opened instead → escalate to §4. Never hand-click tiles - automated clicks get flagged and fail.
3. Text (free)
browser_take_screenshot, read the characters, browser_type the answer, submit. Verified → solved.
4. Image-grid → token service
Read the sitekey (browser_evaluate, read-only):
() => {
const el = document.querySelector(".g-recaptcha, [data-sitekey]");
let key = el?.getAttribute("data-sitekey");
if (!key) {
const f = [...document.querySelectorAll('iframe[src*="recaptcha"]')]
.map((f) => f.src)
.find((s) => /[?&]k=/.test(s));
key = f && new URL(f).searchParams.get("k");
}
return { sitekey: key, pageurl: location.href };
};
hCaptcha: iframe[src*="hcaptcha"] → type:"hcaptcha". Turnstile: .cf-turnstile[data-sitekey] → type:"turnstile".
Solve it server-side (the endpoint resolves the configured key + polls the provider; the skill never sees the key):
RESP=$(curl -fsS -H "authorization: Bearer $JOBPILOT_API_TOKEN" -X POST "$JOBPILOT_API/api/captcha/solve" -H 'content-type: application/json' \
-d "$(jq -n --arg s "$SITEKEY" --arg u "$PAGEURL" '{type:"recaptcha", sitekey:$s, pageurl:$u}')") || true
TOKEN=$(echo "$RESP" | jq -r '.token // empty')
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 85 lines · 40 tokens per session scan A 46344688f701
solve-captcha is a skill published in the GitHub repository suxrobGM/jobpilot (65 stars, last pushed today), licensed MIT. It adds 40 tokens to every session and 1,040 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
job-application-agent
Finds, evaluates, fills, submits, and tracks a candidate's own job applications using a verified resume, evidence-based targeting, secure local profile storage, and browser automation. Use for onboarding or migrating a job-search profile, searching active roles, assessing a posting, applying to an authorized URL or…
apify-collect
Collect fresh job-posting URLs into /.dear-hiring-manager/urls.txt by running an Apify job scraper — the discovery source for /batch. Runs a configured Apify actor via the Apify API (Bearer-header auth) with a search built from the profile's desired titles + level + location, extracts the direct application URL per…
batch
Batch job-application filler. Given several job URLs (or a urls.txt file), run the assisted-apply flow for each in its own browser tab — fit-gate, fill-or-flag, stop before Submit — skipping stale or low-fit postings, then present one combined review table so the human can approve each tab one by one. Use for /batch…
l30
Research any topic from the last 30 days across 5 free sources (Reddit, HN, DDG, Lobsters, GitHub). Deploys a parallel agent swarm to scrape, score, deduplicate, and generate a rich HTML dashboard. Zero API keys required.
playwright
Browser automation and end-to-end testing with Playwright. Use when building/testing frontends, automating user workflows, taking screenshots, validating UI state, filling forms, testing across browsers, or mentions "playwright", "E2E test", "browser automation", "screenshot".
open-hot-jobs
This skill should be used when the user wants to open hot job listings in Chrome. Triggers on phrases like "open hot jobs", "open [category] hot jobs in chrome", "open all backend jobs", "open jobs in browser", "open [category] jobs chrome".