How to use
- Copy the installation command and review the source package before installing it in your own agent environment.
- Check the source document for required tools, credentials and supported hosts.
- Describe your input and desired deliverable; review the output against the source material.
npx skills add https://github.com/instavm/security-skills --skill mitm-find-insecureBefore you start
- Installation does not include a model subscription, API allowance or permission to access your files.
- Repository stars and installation counts describe activity, not an independent quality or security test.
Original skill document
Rendered from the source repository. Headings, examples, code, tables, links, and referenced images are preserved.
Find Insecure Configurations
Analyze the mitmproxy dump (log.txt) for insecure configs for: $ARGUMENTS
Requires:log.txtin the current directory. If it's missing, capture traffic first: ``bash mitmdump --set flow_detail=3 2>&1 | tee log.txt
Security Checks
1. HTTP Instead of HTTPS
- Sensitive data over plain HTTP
- Login/payment pages on HTTP
- Mixed content issues
2. Missing Security Headers
Strict-Transport-Security(HSTS)X-Content-Type-OptionsX-Frame-OptionsContent-Security-PolicyX-XSS-ProtectionReferrer-Policy
3. Insecure Cookies
- Missing
Secureflag - Missing
HttpOnlyflag - Missing
SameSiteattribute - Session cookies without protection
4. CORS Issues
Access-Control-Allow-Origin: *- Credentials allowed with wildcard
- Overly permissive origins
5. SSL/TLS Issues
- SHA1 certificates (deprecated)
- Weak cipher suites
- Outdated TLS versions
6. Information Disclosure
- Sensitive data in GET params
- Debug/verbose errors exposed
- Stack traces in responses
- Internal file paths revealed
Output Format
For each finding:
- Endpoint/Resource: Where issue exists
- Issue: What's misconfigured
- Current Value: What was observed
- Recommended: Secure configuration
- Risk: Potential attack vector
- Severity: Critical/High/Medium/Low/Info
