takeover-2fa

Hand blocked logins, 2FA prompts, and CAPTCHAs to a human without exposing credentials in chat.

Updated Sep 11, 2026
One-click install
npx skills add https://github.com/JYeswak/grok_bot_playground --skill takeover-2fa-jyeswak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: takeover-2fa
Source: https://github.com/JYeswak/grok_bot_playground/tree/main/plugin/skills/takeover-2fa
Command: npx skills add https://github.com/JYeswak/grok_bot_playground --skill takeover-2fa-jyeswak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When an automated task hits a login wall, 2FA prompt, CAPTCHA, or payment check, the risky instinct is to paste a password or one-time code into the conversation. This Skill defines a safe handover procedure so the human completes the verification on the Bot's screen while no credential ever enters the chat transcript. ## Core Features & Use Cases - Credential-free handover: Stops the task at the verification wall, notifies the human with the exact site, page, prompt type, and intended account, then waits without retry loops or bypass attempts. - State-verified resume: Resumes only after confirming the signed-in state from observable page evidence (account name, authenticated dashboard), never from what was typed. - Audit and leak handling: Records every takeover with reason, timestamp, and actor, and treats any credential that reaches chat as burned, triggering a rotation request. - Use Case: A Bot renewing a vendor subscription hits a 2FA prompt mid-checkout. It pauses, messages the operator with the exact blocked step, the operator takes over the shared screen to enter the code, and the Bot resumes the pre-declared next action from the authenticated page. ## Quick Start When a site asks for a password or 2FA code mid-task, stop and hand the screen to me so I can complete the verification, then resume from the signed-in page.

Frequently Asked Questions about takeover-2fa

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I handle a 2FA prompt during browser automation?▼

Stop the task at the prompt, notify the human with the site, page, prompt type, and intended account, then let them take over the screen to enter the code. Resume only after confirming the signed-in state from observable page elements, never from what was typed.

How to hand off a blocked login to a human operator?▼

Send one short message naming the site, the exact verification step, and the account to use, then wait without retry loops or parallel attempts. The human opens the shared screen, completes only the blocked step, and returns control for the pre-declared next action.

Is it safe to paste a one-time code into a chat with a Bot?▼

No. A conversation is durable and shared, so any password or code entered there stays in the transcript permanently. If a credential arrives in chat anyway, treat it as compromised and request an immediate rotation.

Can a Bot bypass a CAPTCHA or reuse a cached session to skip verification?▼

No. Retrying until a prompt gives up, reusing cached cookies to skip verification, or hunting for unprotected paths are bypass attempts. The correct response to any verification wall is to pause and notify the human.

When should takeover not be used for authentication?▼

Do not use it for plugin OAuth, which is completed in the human's own browser under Settings, nor for creating accounts, accepting terms, or making purchases on the owner's behalf. It is only for human-only verification steps mid-task.

What happens to the session after a human signs in on a shared computer?▼

The signed-in session lives on the shared cloud computer and is available to every Bot on the account, not just the one that requested it. Ending the session requires a deliberate sign-out, and the takeover is recorded with reason and timestamp.