Como usar
- Copie o comando e verifique o pacote antes de instalar no seu ambiente de agente.
- Consulte no original as ferramentas, credenciais e ambientes necessários.
- Descreva os dados de entrada e a entrega esperada; confira a saída com as fontes.
npx skills add https://github.com/instavm/security-skills --skill mitm-find-insecureAntes de começar
- A instalação não inclui assinatura de modelo, franquia API ou acesso aos seus arquivos.
- Estrelas e instalações indicam atividade, não um teste independente de qualidade ou segurança.
Documento original do Skill
Renderizado do repositório de origem, preservando títulos, exemplos, código, tabelas, links e imagens.
Find Insecure Configurations
Analyze the mitmproxy dump (log.txt) for insecure configs for: $ARGUMENTS
Requires:log.txtin the current directory. If it's missing, capture traffic first: ``bash mitmdump --set flow_detail=3 2>&1 | tee log.txt
Security Checks
1. HTTP Instead of HTTPS
- Sensitive data over plain HTTP
- Login/payment pages on HTTP
- Mixed content issues
2. Missing Security Headers
Strict-Transport-Security(HSTS)X-Content-Type-OptionsX-Frame-OptionsContent-Security-PolicyX-XSS-ProtectionReferrer-Policy
3. Insecure Cookies
- Missing
Secureflag - Missing
HttpOnlyflag - Missing
SameSiteattribute - Session cookies without protection
4. CORS Issues
Access-Control-Allow-Origin: *- Credentials allowed with wildcard
- Overly permissive origins
5. SSL/TLS Issues
- SHA1 certificates (deprecated)
- Weak cipher suites
- Outdated TLS versions
6. Information Disclosure
- Sensitive data in GET params
- Debug/verbose errors exposed
- Stack traces in responses
- Internal file paths revealed
Output Format
For each finding:
- Endpoint/Resource: Where issue exists
- Issue: What's misconfigured
- Current Value: What was observed
- Recommended: Secure configuration
- Risk: Potential attack vector
- Severity: Critical/High/Medium/Low/Info
