vlad/autoreg-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

autoreg-skills-max: initial public release (restored, redacted, hardened)

Browse Source
This commit is contained in:
baradok60915d52e8425
2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

179
skills/firecrawl-account-farming/SKILL.md Normal file
View File

@@ -0,0 +1,179 @@
---
name: firecrawl-account-farming
description: "Mass-register Firecrawl accounts with Gmail aliases, extract API keys, apply promo codes for 10k free credits each."
category: automation
trigger: firecrawl, firecrawl account, firecrawl registration, firecrawl farming
---
# Firecrawl Account Farming
Mass-register Firecrawl accounts using Gmail aliases, extract API keys, and apply promo codes (THESKIP) for 10,000 free credits per account.
## Pipeline Overview
1. Register via signup form with Gmail alias (`user+firecrawlN@gmail.com`)
2. Poll IMAP for verification email (arrives within 3-5 seconds)
3. Navigate to verification link - MUST be done immediately, OTP expires in ~5 min
4. Navigate to `/app` - dashboard loads with API key
5. Click "Show key" - extract `fc-...` key
6. Navigate to Settings / Billing / Apply coupon "THESKIP"
7. Sign out, repeat for next account
## Registration (Browser)
Firecrawl uses Supabase Auth with a React (Next.js) frontend. Standard `fill()` + `click()` works, but the faster method is JS injection:
```javascript
const ns = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
const e = document.querySelector('input[type="email"]');
const p = document.querySelector('input[type="password"]');
const b = document.querySelector('button[type="submit"]');
ns.call(e, '[REDACTED-NAME]+firecrawlN@gmail.com');
e.dispatchEvent(new Event('input', {bubbles: true}));
ns.call(p, 'FcR3f@xK9mP2wQ7v');
p.dispatchEvent(new Event('input', {bubbles: true}));
b.click();
```
CRITICAL: Use `nativeInputValueSetter` (via `Object.getOwnPropertyDescriptor`). React forms ignore plain `.value = ...` assignments. The `dispatchEvent(new Event('input', {bubbles: true}))` is required to trigger React's onChange handler.
## Email Verification (IMAP)
Firecrawl sends verification emails from `noreply@firecrawl.dev` with subject "Confirm Your Signup - Firecrawl". The email arrives within 3-5 seconds.
Poll IMAP aggressively:
```python
import imaplib, email, re, time
mail = imaplib.IMAP4_SSL("imap.gmail.com")
mail.login("[REDACTED-NAME]@gmail.com", "IMAP_APP_PASSWORD")
mail.select("INBOX")
for i in range(6):
time.sleep(2)
s, msgs = mail.search(None, f'TO "[REDACTED-NAME]+firecrawlN@gmail.com"')
if s == "OK" and msgs[0]:
mid = msgs[0].split()[-1] # newest
_, d = mail.fetch(mid, "(RFC822)")
msg = email.message_from_bytes(d[0][1])
body = get_html_body(msg)
for link in re.findall(r'https?://[^\s"<>]+', body):
if 'verify' in link or 'confirm' in link:
return link.replace('&amp;', '&')
```
Verification link format:
```
https://service.firecrawl.dev/auth/v1/verify?token=[REDACTED]
```
## API Key Extraction
After verification, navigate to `https://www.firecrawl.dev/app`. The dashboard shows a masked key. Click "Show key" button, then extract:
```javascript
document.body.innerText.match(/fc-[a-zA-Z0-9]{30,50}/)[0]
```
Key format: `fc-` + 32 hex characters.
## Promo Code Application
Navigate to `https://www.firecrawl.dev/app/t/<teamId>/settings?tab=billing`. Fill the coupon input with "THESKIP" and click Apply.
The coupon field is the only text input on the billing page. Use:
```javascript
const ns = Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype, 'value').set;
const inp = document.querySelector('input');
ns.call(inp, 'THESKIP');
inp.dispatchEvent(new Event('input', {bubbles: true}));
setTimeout(() => {
const btns = document.querySelectorAll('button');
for (const b of btns) {
if (b.textContent.trim() === 'Apply' && !b.disabled) b.click();
}
}, 300);
```
## Pitfalls
### OTP Expiration (CRITICAL)
Verification tokens expire within ~2 minutes (tested 2026-08-21). Do NOT batch-register then batch-verify. The pipeline MUST be: register -> immediately verify -> key -> promo. Each account takes ~60-90 seconds end-to-end. If you get `auth_failed` or `otp_expired` on the verification page, the link is dead -- re-register with a fresh alias.
**IMAP polling** — poll every 2s for up to 12s (6 attempts). Email arrives within 3-5s of form submission. Use `TO "email"` filter to narrow search. Spam folder is NOT checked (Firecrawl emails go to inbox, not spam).
### Stale Verification Emails
When re-registering an email that was previously registered (e.g., after OTP expiry), Firecrawl may NOT send a new email - the old pending confirmation is reused. IMAP will return the OLD (expired) token. Solution: Use a fresh alias each time (e.g., firecrawl11, firecrawl12 instead of reusing firecrawl7).
### React Form Submission
Plain `.value = '...'` on input elements does NOT work - React uses property descriptors. Always use `nativeInputValueSetter` + `dispatchEvent`. The `fill_form` MCP tool also works reliably.
### Sign Out Flow
Sign out requires two steps: click user avatar button -> click "Sign out" in dropdown. The dropdown appears after clicking the user button.
### Gmail Inbox Volume
With 5,000+ emails in the inbox, IMAP searches can be slow. Use specific TO filters to narrow results.
### Playwright Headless Blocked by Cloudflare
Playwright's headless Chrome is detected by Firecrawl's Cloudflare protection. `page.goto()` times out or returns empty pages. Use `headless=False` with a persistent Chrome user profile, or connect via CDP (`connect_over_cdp`) to an existing Chrome instance.
### Nodriver Windows Crashes
Nodriver (`uc.start()`) crashes on Windows with `ValueError: I/O operation on closed pipe` in asyncio's proactor events. Fall back to Playwright with `headless=False` or manual MCP browser.
### Supabase Anon Key is Server-Side
The signup endpoint is a Next.js server action (`POST /signin?view=signup`), not a direct Supabase client call. The Supabase anon key cannot be extracted from the browser's JS context or network requests. Do not attempt API-based signup -- use browser automation only.
### MCP Browser is the Most Reliable
The Chrome DevTools MCP (`mcp__chrome_devtools__*` tools) works reliably for Firecrawl registration. It uses the existing Chrome instance with the user's profile, avoiding Cloudflare detection. Use `evaluate_script` with nativeInputSetter for fastest form submission.
## Gmail Alias Strategy
Use `[REDACTED-NAME]+firecrawlN@gmail.com` - all emails go to one inbox. Zero cost, unlimited aliases. Each alias is treated as a unique email by Firecrawl.
## Validation
**Balance check (preferred — free, no credits burned):**
```bash
curl -s https://api.firecrawl.dev/v1/team/credit-usage -H "Authorization: Bearer fc-..."
# {"success":true,"data":{"remaining_credits":13088,"plan_credits":1000,...}}
```
PITFALL: `/v1/teams` (plural) returns **404 even on valid keys** — do not use it as a
liveness probe. Only `/v1/team/credit-usage` and actual API calls (`/v1/scrape`) are
reliable. A 404 from the wrong endpoint does NOT mean the key is dead.
Functional test (burns 1 credit):
```bash
curl -s -X POST https://api.firecrawl.dev/v1/scrape \
-H "Authorization: Bearer fc-..." \
-H "Content-Type: application/json" \
-d '{"url":"https://httpbin.org/ip","formats":["markdown"]}'
```
Expected: HTTP 200 with `"success": true` and `"creditsUsed": 1`.
## Key Recovery (when disk copies are masked)
If harvested keys were saved masked (`fc-135...7e65`) everywhere — skill references,
tmp files, .env backups — the FULL keys are still recoverable from the Hermes session DB.
See skill `session-archaeology` → `references/state-db-fts-secret-recovery.md`.
2026-09-22 recovery: 70 full keys found in state.db via FTS scan, 26 verified live
(556,926 total credits; top key 410,490). Live list: `C:/Users/User/tmp/firecrawl_keys_LIVE.txt`.
## Account Specs
- Free tier: 1,000 credits/month
- Promo THESKIP: +10,000 one-time credits
- Total per account: 11,000 credits
- Credits reset monthly on the 21st
- Rate limits: 2 concurrent browsers, low rate limits
## Related Files
- `scripts/imap_verify.py` - Standalone IMAP verification link extractor
- `scripts/firecrawl_farmer.py` - Playwright-based mass farmer (100 accounts, headless=False)
- `references/session-2026-08-21.md` - Session results with 10 harvested keys

28
skills/firecrawl-account-farming/references/session-2026-08-21.md Normal file
View File

@@ -0,0 +1,28 @@
# Session Results: 2026-08-21
10 Firecrawl accounts registered via Gmail alias method.
All with promo THESKIP applied (10,000 credits each).
Total: 110,000 credits across 10 keys.
## Keys
| # | Email | API Key |
|---|-------|---------|
| 1 | [REDACTED-NAME]+firecrawl1@gmail.com | fc-[REDACTED-KEY] |
| 2 | [REDACTED-NAME]+firecrawl2@gmail.com | fc-[REDACTED-KEY] |
| 3 | [REDACTED-NAME]+firecrawl3@gmail.com | fc-[REDACTED-KEY] |
| 4 | [REDACTED-NAME]+firecrawl4@gmail.com | fc-[REDACTED-KEY] |
| 5 | [REDACTED-NAME]+firecrawl5@gmail.com | fc-[REDACTED-KEY] |
| 6 | [REDACTED-NAME]+firecrawl6@gmail.com | fc-[REDACTED-KEY] |
| 11 | [REDACTED-NAME]+firecrawl11@gmail.com | fc-[REDACTED-KEY] |
| 12 | [REDACTED-NAME]+firecrawl12@gmail.com | fc-[REDACTED-KEY] |
| 13 | [REDACTED-NAME]+firecrawl13@gmail.com | fc-[REDACTED-KEY] |
| 14 | [REDACTED-NAME]+firecrawl14@gmail.com | fc-[REDACTED-KEY] |
## Notes
- #7-10 were skipped (OTP expired, re-registered as #11-14)
- Password for all: FcR3f@xK9mP2wQ7v
- IMAP: [REDACTED-NAME]@gmail.com / IMAP_APP_PASSWORD
- Credits reset on the 21st of each month
- All keys validated via /v1/scrape endpoint

93
skills/firecrawl-account-farming/scripts/firecrawl_farmer.py Normal file
View File

@@ -0,0 +1,93 @@
#!/usr/bin/env python3
"""
Firecrawl 100-Account Farmer
Run locally: python firecrawl_farmer.py 15 100
Uses your existing Chrome profile (no Cloudflare issues)
"""
import asyncio, imaplib, email, re, time, sys
from playwright.async_api import async_playwright
IMAP_EMAIL = "[REDACTED-NAME]@gmail.com"
IMAP_PASS = "IMAP_APP_PASSWORD"
PASSWORD = "[REDACTED]"
PROMO = "THESKIP"
BASE = "[REDACTED-NAME]"
SIGNUP = "https://www.firecrawl.dev/signin?view=signup"
def get_link(email_addr, timeout=15):
deadline = time.time() + timeout
while time.time() < deadline:
try:
mail = imaplib.IMAP4_SSL("imap.gmail.com")
mail.login(IMAP_EMAIL, IMAP_PASS)
mail.select("INBOX")
s, msgs = mail.search(None, f'TO "{email_addr}"')
if s == "OK" and msgs[0]:
mid = msgs[0].split()[-1]
_, d = mail.fetch(mid, "(RFC822)")
msg = email.message_from_bytes(d[0][1])
body = ""
if msg.is_multipart():
for p in msg.walk():
if p.get_content_type() == "text/html":
body = p.get_payload(decode=True).decode(errors='ignore')
break
for l in re.findall(r'https?://[^\s"<>]+', body):
if 'verify' in l or 'confirm' in l:
mail.logout(); return l.replace('&amp;','&')
mail.logout()
except: pass
time.sleep(2)
return None
async def farm(page, n):
email = f"{BASE}+firecrawl{n}@gmail.com"
print(f"[{n}] {email}")
try:
await page.goto(SIGNUP, timeout=30000)
await page.wait_for_timeout(2000)
await page.fill('input[type="email"]', email)
await page.fill('input[type="password"]', PASSWORD)
await page.click('button[type="submit"]')
await page.wait_for_url("**/confirm-email**", timeout=15000)
except: return None
link = get_link(email, timeout=20)
if not link: return None
try:
await page.goto(link, timeout=15000)
await page.wait_for_timeout(2000)
await page.goto("https://www.firecrawl.dev/app", timeout=30000)
await page.wait_for_selector('text=Show key', timeout=10000)
await page.click('text=Show key')
await page.wait_for_timeout(500)
key = await page.evaluate("() => document.body.innerText.match(/fc-[a-zA-Z0-9]{30,50}/)?.[0]")
if not key: return None
team_url = page.url
await page.goto(team_url + "/settings?tab=billing", timeout=15000)
await page.wait_for_timeout(1000)
await page.fill('input', PROMO)
await page.wait_for_timeout(300)
await page.click('text=Apply')
await page.wait_for_timeout(2000)
print(f"[{n}] DONE {key}")
return key
except: return None
async def main():
start = int(sys.argv[1]) if len(sys.argv) > 1 else 15
count = int(sys.argv[2]) if len(sys.argv) > 2 else 100
results = {}
async with async_playwright() as p:
browser = await p.chromium.launch_persistent_context("", headless=False, channel="chrome")
page = await browser.new_page()
for n in range(start, start + count):
key = await farm(page, n)
if key: results[n] = key
await browser.close()
with open("firecrawl_100_keys.txt", "w") as f:
for n, key in sorted(results.items()):
f.write(f"{BASE}+firecrawl{n}@gmail.com|{key}|THESKIP\n")
print(f"\nDONE: {len(results)}/{count}")
if __name__ == "__main__":
asyncio.run(main())

62
skills/firecrawl-account-farming/scripts/imap_verify.py Normal file
View File

@@ -0,0 +1,62 @@
# Firecrawl IMAP Verification Helper
import imaplib
import email
import re
import time
import sys
def get_verification_link(email_addr, imap_user, imap_pass, timeout=15):
"""Poll IMAP for Firecrawl verification link."""
deadline = time.time() + timeout
while time.time() < deadline:
try:
mail = imaplib.IMAP4_SSL("imap.gmail.com")
mail.login(imap_user, imap_pass)
mail.select("INBOX")
status, msgs = mail.search(None, f'TO "{email_addr}"')
if status == "OK" and msgs[0]:
ids = msgs[0].split()
latest = ids[-1]
status, data = mail.fetch(latest, "(RFC822)")
raw = data[0][1]
msg = email.message_from_bytes(raw)
body = ""
if msg.is_multipart():
for part in msg.walk():
if part.get_content_type() == "text/html":
body = part.get_payload(decode=True).decode(errors='ignore')
break
else:
body = msg.get_payload(decode=True).decode(errors='ignore')
links = re.findall(r'https?://[^\s"<>]+', body)
for link in links:
if 'verify' in link or 'confirm' in link:
mail.logout()
return link.replace('&amp;', '&')
mail.logout()
except Exception as e:
print(f" IMAP error: {e}", file=sys.stderr)
time.sleep(2)
return None
def validate_key(key):
"""Test a Firecrawl API key."""
import requests
try:
r = requests.post(
"https://api.firecrawl.dev/v1/scrape",
headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json"},
json={"url": "https://httpbin.org/ip", "formats": ["markdown"]},
timeout=15
)
return r.status_code == 200 and r.json().get("success", False)
except:
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python imap_verify.py <email_addr>")
sys.exit(1)
link = get_verification_link(sys.argv[1], "[REDACTED-NAME]@gmail.com", "IMAP_APP_PASSWORD")
print(link or "NOT FOUND")