Skills api-mitmproxy

📦

api-mitmproxy

Name: api-mitmproxy
Author: AgentSecOps

v0.1.0 Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts

Test APIs with mitmproxy

API traffic is difficult to inspect, modify, and replay across clients. This skill provides structured mitmproxy workflows for authorized security testing and debugging.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "api-mitmproxy" from https://skillstore.io/skills/agentsecops-api-mitmproxy.md and its manifest at https://skillstore.io/api/skills/agentsecops-api-mitmproxy/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-api-mitmproxy.md Signed manifest GET /api/skills/agentsecops-api-mitmproxy/manifest Signed lockfile GET /api/skills/agentsecops-api-mitmproxy/lockfile

Test it

Using "api-mitmproxy". Inspect login traffic without exposing credentials.

Expected outcome:

Run the proxy on loopback and configure only the test client.
Capture authentication flow metadata while fully redacting passwords, cookies, and authorization values.
Remove the interception certificate and securely delete sensitive captures after review.

Using "api-mitmproxy". Prepare a GraphQL authorization test.

Expected outcome:

The plan identifies target operations, controlled identities, request variants, expected denials, captured evidence, and restoration steps.

Using "api-mitmproxy". Review a CI traffic-capture workflow.

Expected outcome:

Pin tools and actions to reviewed versions.
Use job-scoped credentials with minimum permissions.
Keep flow files encrypted and restrict artifact access and retention.

Security Audit

Critical

v9 • 7/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown fences, educational vulnerable-code examples, and documented security references. Confirmed risks include a mutable remote script piped to Bash, third-party token access, unauthenticated all-interface proxy bindings, and destructive certificate reset guidance. Additional concerns are mutable CI action references, authorization token logging, and persistent interception CA trust.

Files scanned

2,014

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

Critical

assets/ci-config-template.yml:240

Pipe to shell pattern

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The workflow pipes an unverified installer from a mutable GitHub branch directly into Bash. This creates a direct CI supply-chain execution path.

Critical

SKILL.md:434

Recursive delete on root/home

rm -rf ~/.mitmproxy/

The troubleshooting command recursively deletes the entire mitmproxy home directory without backup or confirmation. It can destroy custom configuration, certificates, keys, and saved state.

High

assets/ci-config-template.yml:161-164 assets/ci-config-template.yml:196-199

Mutable Third-Party CI Actions

The CI template executes third-party actions through mutable tags, including @master, while exposing repository data and a GitHub token.

The action references are visibly tag-based, and @master is mutable. GitHub Actions execute code with job workspace and permission access.

Medium

SKILL.md:227-242

Authorization Token Logging

An addon captures Authorization values and prints the first 20 characters, which can expose reusable credential material in console or CI logs.

The example explicitly stores Authorization header values and prints a token prefix. Log access can reveal sensitive credential material.

Medium

SKILL.md:196-215

Persistent Interception CA Trust

The workflow installs and enables trust for an interception CA on client devices without directing users to remove that trust after testing.

The instructions install and trust the mitmproxy CA on Android and iOS. No cleanup step removes the trusted CA after the assessment.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

assets/ci-config-template.yml:164

Git platform tokens

GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The workflow provides GITHUB_TOKEN to a third-party action referenced by a mutable version tag. A compromised action could use the token's repository permissions.

High

SKILL.md:434

Hidden file in home directory

rm -rf ~/.mitmproxy/

The troubleshooting command recursively deletes the entire mitmproxy home directory without backup or confirmation. It can destroy custom configuration, certificates, keys, and saved state.

Medium

SKILL.md:65

Hardcoded IP address

mitmproxy --mode regular --listen-host 0.0.0.0 --listen-port 8080

The guidance binds an intercepting proxy to 0.0.0.0 without requiring authentication or firewall restrictions. Other reachable hosts could abuse the proxy or access traffic.

Medium

SKILL.md:68

Hardcoded IP address

mitmweb --mode regular --listen-host 0.0.0.0 --listen-port 8080

The guidance binds an intercepting proxy to 0.0.0.0 without requiring authentication or firewall restrictions. Other reachable hosts could abuse the proxy or access traffic.

Medium

SKILL.md:163

Hardcoded IP address

mitmproxy --mode reverse:https://api.example.com --listen-host 0.0.0.0 --listen-port 443

The guidance binds an intercepting proxy to 0.0.0.0 without requiring authentication or firewall restrictions. Other reachable hosts could abuse the proxy or access traffic.

Medium

SKILL.md:443

Hardcoded IP address

- Ensure mitmproxy is listening on correct interface (0.0.0.0)

The guidance binds an intercepting proxy to 0.0.0.0 without requiring authentication or firewall restrictions. Other reachable hosts could abuse the proxy or access traffic.

Medium

SKILL.md:434

Hidden file access

rm -rf ~/.mitmproxy/

The troubleshooting command recursively deletes the entire mitmproxy home directory without backup or confirmation. It can destroy custom configuration, certificates, keys, and saved state.

Low

assets/ci-config-template.yml:240

Hardcoded URL

curl -s https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh | bash

The URL selects a mutable branch-hosted installer and sends its response directly to Bash. Changed or compromised remote content would execute in CI.

Risk Factors

⚙️ External commands (50)

🌐 Network access (39)

📁 Filesystem access (9)

assets/ci-config-template.yml:323 assets/ci-config-template.yml:323 SKILL.md:260 SKILL.md:207 SKILL.md:431 SKILL.md:434 SKILL.md:207 SKILL.md:431 SKILL.md:434

🔑 Env variables (23)

⚡ Contains scripts (2)

references/EXAMPLE.md:138 references/EXAMPLE.md:137

Detected Patterns

Pipe to shell patternRecursive delete on root/home

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/agentsecops-api-mitmproxy/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-api-mitmproxy/security.svg)](https://skillstore.io/skills/agentsecops-api-mitmproxy?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-api-mitmproxy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-api-mitmproxy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-api-mitmproxy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). api-mitmproxy security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-api-mitmproxy/audits/9

BibTeX citation

@techreport{agentsecops-agentsecops-api-mitmproxy-2026,
  author = {AgentSecOps},
  title = {api-mitmproxy security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/agentsecops-api-mitmproxy/audits/9},
  note = {Author version 0.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "api-mitmproxy security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
  - name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-api-mitmproxy/audits/9"
identifiers:
  - type: other
    value: "skillstore:agentsecops-api-mitmproxy:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Debug API requests

Inspect requests, responses, headers, and WebSocket messages while developing an API client.

Assess API controls

Modify and replay authorized traffic to evaluate authentication, authorization, input validation, and business logic.

Inspect mobile traffic

Configure a test device, install the interception certificate, and analyze application API behavior.

Try These Prompts

Start local inspection

Guide me through inspecting traffic from [client] to [API] with mitmweb on loopback. Include certificate setup and safe cleanup.

Filter relevant traffic

Create a mitmproxy workflow that captures only [domain] and [methods], saves flows, and exports a reviewable HAR file.

Design an addon

Design a Python addon for authorized testing of [control]. Redact credentials, preserve original requests, and define evidence to collect.

Plan an assessment

Plan an end-to-end assessment for [application]. Cover proxy architecture, mobile pinning, replay controls, OWASP tests, evidence handling, and cleanup.

Best Practices

Test only systems and accounts covered by written authorization.
Use isolated environments, loopback bindings, and minimum network exposure.
Redact secrets and remove trusted interception certificates after testing.

Avoid

Do not intercept production traffic without explicit authorization and a data-handling plan.
Do not log complete tokens, cookies, passwords, or personal data.
Do not pipe remote installers to a shell or use mutable CI action references.