profile-website-bot-detection by kernel/skills
npx skills add https://github.com/kernel/skills --skill profile-website-bot-detection分析目标网站以识别机器人检测供应商、其具体产品和挑战类型。支持隐身与非隐身浏览器模式之间的对比分析。
jq (brew install jq 或 apt install jq)KERNEL_API_KEY 环境变量。如果未设置,请提示用户提供。比较隐身与非隐身浏览器之间的机器人检测行为,以评估隐身效果。
# 创建隐身浏览器(使用 -s 标志)
kernel browsers create -s --viewport 1920x1080@25 -t 300
# 将 session_id 保存为 STEALTH_ID
# 创建非隐身有头浏览器(不使用 -s 标志)
kernel browsers create --viewport 1920x1080@25 -t 300
# 将 session_id 保存为 NORMAL_ID
cd scripts
npm install # 仅首次运行需要
# 使用隐身浏览器测试
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$STEALTH_ID TARGET_URL=<url> BROWSER_MODE=stealth npm run analyze
# 使用非隐身浏览器测试
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$NORMAL_ID TARGET_URL=<url> BROWSER_MODE=normal npm run analyze
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
比较供应商检测和拦截行为:
# 设置主机名文件夹(例如,chase.com 对应 chase-com)
HOST=chase-com
# 快速结果比较
echo "=== 隐身模式结果 ===" && cat output/$HOST/stealth/report-*.json | jq '.summary.verdict'
echo "=== 普通模式结果 ===" && cat output/$HOST/normal/report-*.json | jq '.summary.verdict'
# 比较拦截状态
echo "=== 隐身模式拦截状态 ===" && cat output/$HOST/stealth/report-*.json | jq '.summary | {isBlocked, blockedPages, blockedVendors}'
echo "=== 普通模式拦截状态 ===" && cat output/$HOST/normal/report-*.json | jq '.summary | {isBlocked, blockedPages, blockedVendors}'
# 比较检测到的供应商
echo "=== 隐身模式检测到的供应商 ===" && cat output/$HOST/stealth/report-*.json | jq '.summary.vendorNames'
echo "=== 普通模式检测到的供应商 ===" && cat output/$HOST/normal/report-*.json | jq '.summary.vendorNames'
| 场景 | 隐身模式 | 普通模式 | 含义 |
|---|---|---|---|
| 未检测到供应商 | 0 | 0 | 网站没有机器人检测 |
| 检测到相同供应商,均未拦截 | N | N | 存在机器人检测,两者均通过 |
| 普通模式被拦截,隐身模式通过 | 0 次拦截 | 被拦截 | 隐身模式有效 |
| 两者均被拦截 | 被拦截 | 被拦截 | 机器人检测击败了隐身模式 |
| 不同的挑战类型 | 较轻 | 较难 | 隐身模式降低了怀疑程度 |
运行对比分析后,向用户提供详细的摘要报告,包括:
摘要报告模板:
## 机器人检测对比分析:[TARGET_URL]
### 结果
- **隐身浏览器**:[来自 summary.verdict 的结果]
- **普通浏览器**:[来自 summary.verdict 的结果]
- **隐身效果**:[有效/无效/不确定]
### 拦截状态
| 浏览器 | 是否被拦截 | 拦截类型 | 证据 |
|---------|---------|------------|----------|
| 隐身模式 | [是/否] | [blockType 或 N/A] | [首个证据项] |
| 普通模式 | [是/否] | [blockType 或 N/A] | [首个证据项] |
### 检测到的供应商
| 供应商 | 隐身模式 | 普通模式 | 产品 |
|--------|---------|--------|----------|
| [供应商] | ✓/✗ | ✓/✗ | [产品列表] |
### 分析
- [解释结果的含义]
- [注意隐身与普通模式之间的任何差异]
- [如果被拦截,建议后续步骤]
### 关键发现
1. [发现 1]
2. [发现 2]
3. [发现 3]
使用 JSON 报告填充此模板:
summary.verdict - 最终结果字符串summary.isBlocked - 浏览器是否被拦截summary.blockedPages - 被拦截页面的详细信息summary.vendorNames - 检测到的供应商列表vendorDetections - 详细的供应商/产品信息kernel browsers delete -y $STEALTH_ID
kernel browsers delete -y $NORMAL_ID
分析检测供应商及其具体产品:
| 供应商 | 检测到的产品 |
|---|---|
| Akamai | Bot Manager, Bot Manager Premier, mPulse RUM, Sensor Script, Edge DNS |
| Cloudflare | Bot Management, Turnstile, Challenge Platform, JS Challenge, Managed Challenge |
| DataDome | Interstitial Challenge, Slider Challenge, Device Check, Picasso Fingerprint |
| HUMAN/PerimeterX | Bot Defender, Sensor SDK, Press & Hold Challenge |
| Imperva/Incapsula | Advanced Bot Protection (utmvc), Advanced Bot Protection (reese84), WAF |
| Kasada | IPS (Initial Page Security), FP (Fingerprint Endpoint), Telemetry, POW Challenge |
| reCAPTCHA v2, reCAPTCHA v3, reCAPTCHA Enterprise | |
| hCaptcha | Widget, Enterprise |
| FingerprintJS | Fingerprint Pro, BotD |
| Arkose Labs | FunCaptcha |
检测方法:
_abck、__cf_bm、datadome、_px*)cf-ray、x-kpsdk-*、x-d-token)供应商特定检查:
dd.t === 'bv')~0~ 指示器)脚本自动分析:
/login、/signin 等)由于防止凭据填充,登录页面通常具有更激进的机器人检测。
结果按目标主机名组织在 scripts/output/<主机名>/<模式>/ 中:
report-<时间戳>.json - 包含供应商检测的完整 JSON 报告screenshot-homepage-<时间戳>.png - 首页截图screenshot-login-<时间戳>.png - 登录页面截图(如果找到)在 chase.com 上进行对比测试的示例结构:
output/chase-com/
├── stealth/
│ ├── report-*.json
│ ├── screenshot-homepage-*.png
│ └── screenshot-login-*.png
└── normal/
├── report-*.json
├── screenshot-homepage-*.png
└── screenshot-login-*.png
JSON 报告包括:
summary: 快速访问结果、拦截状态和供应商名称
verdict: 人类可读的结果(例如,"BLOCKED - homepage (Error Page)")isBlocked: 布尔值 - 如果任何页面被拦截则为 truevendorNames: 检测到的供应商名称数组blockedPages: 带有证据的被拦截页面详细信息vendorDetections: 检测到的供应商及其产品、URL、Cookie、头部的映射blockDetections: 每个页面的详细拦截分析vendorScriptsDetected: 检测到的供应商脚本的 URL(不保存到磁盘)networkRequests/networkResponses: 所有与供应商匹配的请求cookies: 所有带有供应商归属的 Cookie# 创建两种浏览器
STEALTH_ID=$(kernel browsers create -s --viewport 1920x1080@25 -t 300 -o json | jq -r '.session_id')
NORMAL_ID=$(kernel browsers create --viewport 1920x1080@25 -t 300 -o json | jq -r '.session_id')
echo "隐身模式: $STEALTH_ID"
echo "普通模式: $NORMAL_ID"
# 在两者上运行分析
cd scripts
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$STEALTH_ID TARGET_URL=chase.com BROWSER_MODE=stealth npm run analyze
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$NORMAL_ID TARGET_URL=chase.com BROWSER_MODE=normal npm run analyze
# 输出结构:
# ./output/chase-com/stealth/report-*.json
# ./output/chase-com/stealth/screenshot-*.png
# ./output/chase-com/normal/report-*.json
# ./output/chase-com/normal/screenshot-*.png
# 快速比较 - 检查结果
echo "--- 隐身模式结果 ---"
cat output/chase-com/stealth/report-*.json | jq '.summary.verdict'
echo "--- 普通模式结果 ---"
cat output/chase-com/normal/report-*.json | jq '.summary.verdict'
# 详细的供应商比较
echo "--- 隐身模式检测到的供应商 ---"
cat output/chase-com/stealth/report-*.json | jq '.summary.vendorNames'
echo "--- 普通模式检测到的供应商 ---"
cat output/chase-com/normal/report-*.json | jq '.summary.vendorNames'
# 清理
kernel browsers delete -y $STEALTH_ID
kernel browsers delete -y $NORMAL_ID
_abck (核心验证), bm_sz, bm_sv~0~ = 有效会话__cf_bm, cf_clearance/cdn-cgi/challenge-platform/challenges.cloudflare.com/turnstiledatadomedd.t === 'bv' = 硬 IP 拦截(需要更改 IP,解决验证码无效)_px2, _px3, _pxhd/_Incapsula_Resource 的脚本x-d-token 头部x-kpsdk-ct, x-kpsdk-cdips.js/fp 指纹请求每周安装量
100
代码仓库
GitHub 星标数
3
首次出现
2026年3月3日
安全审计
安装于
codex100
cursor100
claude-code96
opencode10
gemini-cli10
github-copilot10
Analyzes a target website to identify bot detection vendors, their specific products, and challenge types. Supports comparative analysis between stealth and non-stealth browser modes.
jq installed (brew install jq or apt install jq)KERNEL_API_KEY environment variable set. If it is not set, prompt the user to supply.Compare bot detection behavior between stealth and non-stealth browsers to evaluate stealth effectiveness.
# Create stealth browser (with -s flag)
kernel browsers create -s --viewport 1920x1080@25 -t 300
# Save session_id as STEALTH_ID
# Create non-stealth headful browser (no -s flag)
kernel browsers create --viewport 1920x1080@25 -t 300
# Save session_id as NORMAL_ID
cd scripts
npm install # first run only
# Test with stealth browser
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$STEALTH_ID TARGET_URL=<url> BROWSER_MODE=stealth npm run analyze
# Test with non-stealth browser
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$NORMAL_ID TARGET_URL=<url> BROWSER_MODE=normal npm run analyze
Compare the vendor detections and blocking behavior:
# Set the hostname folder (e.g., chase-com for chase.com)
HOST=chase-com
# Quick verdict comparison
echo "=== STEALTH VERDICT ===" && cat output/$HOST/stealth/report-*.json | jq '.summary.verdict'
echo "=== NORMAL VERDICT ===" && cat output/$HOST/normal/report-*.json | jq '.summary.verdict'
# Compare block status
echo "=== STEALTH BLOCKED ===" && cat output/$HOST/stealth/report-*.json | jq '.summary | {isBlocked, blockedPages, blockedVendors}'
echo "=== NORMAL BLOCKED ===" && cat output/$HOST/normal/report-*.json | jq '.summary | {isBlocked, blockedPages, blockedVendors}'
# Compare detected vendors
echo "=== STEALTH VENDORS ===" && cat output/$HOST/stealth/report-*.json | jq '.summary.vendorNames'
echo "=== NORMAL VENDORS ===" && cat output/$HOST/normal/report-*.json | jq '.summary.vendorNames'
| Scenario | Stealth | Normal | Meaning |
|---|---|---|---|
| No vendors detected | 0 | 0 | Site has no bot detection |
| Same vendors, no blocks | N | N | Bot detection present, both pass |
| Normal blocked, stealth passes | 0 blocks | Blocked | Stealth mode is effective |
| Both blocked | Blocked | Blocked | Bot detection defeats stealth |
| Different challenge types | Lighter | Harder | Stealth reduces suspicion |
After running the comparative analysis, provide a detailed summary report to the user that includes:
Summary Report Template:
## Bot Detection Comparative Analysis: [TARGET_URL]
### Verdict
- **Stealth Browser**: [verdict from summary.verdict]
- **Normal Browser**: [verdict from summary.verdict]
- **Stealth Effectiveness**: [Effective/Ineffective/Inconclusive]
### Block Status
| Browser | Blocked | Block Type | Evidence |
|---------|---------|------------|----------|
| Stealth | [Yes/No] | [blockType or N/A] | [first evidence item] |
| Normal | [Yes/No] | [blockType or N/A] | [first evidence item] |
### Detected Vendors
| Vendor | Stealth | Normal | Products |
|--------|---------|--------|----------|
| [vendor] | ✓/✗ | ✓/✗ | [product list] |
### Analysis
- [Explain what the results mean]
- [Note any differences between stealth and normal]
- [Recommend next steps if blocked]
### Key Findings
1. [Finding 1]
2. [Finding 2]
3. [Finding 3]
Use the JSON reports to populate this template:
summary.verdict - The final verdict stringsummary.isBlocked - Whether the browser was blockedsummary.blockedPages - Details about blocked pagessummary.vendorNames - List of detected vendorsvendorDetections - Detailed vendor/product informationkernel browsers delete -y $STEALTH_ID
kernel browsers delete -y $NORMAL_ID
The analysis detects vendors and their specific products:
| Vendor | Products Detected |
|---|---|
| Akamai | Bot Manager, Bot Manager Premier, mPulse RUM, Sensor Script, Edge DNS |
| Cloudflare | Bot Management, Turnstile, Challenge Platform, JS Challenge, Managed Challenge |
| DataDome | Interstitial Challenge, Slider Challenge, Device Check, Picasso Fingerprint |
| HUMAN/PerimeterX | Bot Defender, Sensor SDK, Press & Hold Challenge |
| Imperva/Incapsula | Advanced Bot Protection (utmvc), Advanced Bot Protection (reese84), WAF |
| Kasada | IPS (Initial Page Security), FP (Fingerprint Endpoint), Telemetry, POW Challenge |
| reCAPTCHA v2, reCAPTCHA v3, reCAPTCHA Enterprise | |
| hCaptcha | Widget, Enterprise |
| FingerprintJS | Fingerprint Pro, BotD |
Detection methods:
_abck, __cf_bm, datadome, _px*)cf-ray, x-kpsdk-*, x-d-token)Vendor-specific checks:
dd.t === 'bv')~0~ indicator)The script automatically analyzes:
/login, /signin, etc.)Login pages often have more aggressive bot detection due to credential stuffing prevention.
Results are organized by target hostname in scripts/output/<hostname>/<mode>/:
report-<timestamp>.json - Full JSON report with vendor detectionsscreenshot-homepage-<timestamp>.png - Homepage screenshotscreenshot-login-<timestamp>.png - Login page screenshot (if found)Example structure for comparative test on chase.com:
output/chase-com/
├── stealth/
│ ├── report-*.json
│ ├── screenshot-homepage-*.png
│ └── screenshot-login-*.png
└── normal/
├── report-*.json
├── screenshot-homepage-*.png
└── screenshot-login-*.png
The JSON report includes:
summary: Quick access to verdict, block status, and vendor names
verdict: Human-readable result (e.g., "BLOCKED - homepage (Error Page)")isBlocked: Boolean - true if any page was blockedvendorNames: Array of detected vendor namesblockedPages: Details of blocked pages with evidencevendorDetections: Map of detected vendors with products, URLs, cookies, headersblockDetections: Detailed block analysis for each pagevendorScriptsDetected: URLs of detected vendor scripts (not saved to disk)networkRequests/networkResponses: All requests with vendor matching# Create both browsers
STEALTH_ID=$(kernel browsers create -s --viewport 1920x1080@25 -t 300 -o json | jq -r '.session_id')
NORMAL_ID=$(kernel browsers create --viewport 1920x1080@25 -t 300 -o json | jq -r '.session_id')
echo "Stealth: $STEALTH_ID"
echo "Normal: $NORMAL_ID"
# Run analysis on both
cd scripts
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$STEALTH_ID TARGET_URL=chase.com BROWSER_MODE=stealth npm run analyze
KERNEL_API_KEY=$KERNEL_API_KEY KERNEL_BROWSER_ID=$NORMAL_ID TARGET_URL=chase.com BROWSER_MODE=normal npm run analyze
# Output structure:
# ./output/chase-com/stealth/report-*.json
# ./output/chase-com/stealth/screenshot-*.png
# ./output/chase-com/normal/report-*.json
# ./output/chase-com/normal/screenshot-*.png
# Quick comparison - check verdicts
echo "--- Stealth verdict ---"
cat output/chase-com/stealth/report-*.json | jq '.summary.verdict'
echo "--- Normal verdict ---"
cat output/chase-com/normal/report-*.json | jq '.summary.verdict'
# Detailed vendor comparison
echo "--- Stealth vendors ---"
cat output/chase-com/stealth/report-*.json | jq '.summary.vendorNames'
echo "--- Normal vendors ---"
cat output/chase-com/normal/report-*.json | jq '.summary.vendorNames'
# Cleanup
kernel browsers delete -y $STEALTH_ID
kernel browsers delete -y $NORMAL_ID
_abck (core validation), bm_sz, bm_sv~0~ in _abck value = valid session__cf_bm, cf_clearance/cdn-cgi/challenge-platform/challenges.cloudflare.com/turnstiledatadomedd.t === 'bv' = hard IP block (changing IP required, solving captcha won't help)_px2, _px3, _pxhd/_Incapsula_Resourcex-d-token headerx-kpsdk-ct, x-kpsdk-cdips.js first/fp fingerprint requestsWeekly Installs
100
Repository
GitHub Stars
3
First Seen
Mar 3, 2026
Security Audits
Gen Agent Trust HubPassSocketWarnSnykWarn
Installed on
codex100
cursor100
claude-code96
opencode10
gemini-cli10
github-copilot10
通过 LiteLLM 代理让 Claude Code 对接 GitHub Copilot 运行 | 高级变通方案指南
44,900 周安装
| FunCaptcha |
cookies: All cookies with vendor attribution