instavm/security-skills

mitm-find-auth

Find authentication and session vulnerabilities. Use when user asks about auth bypass, session issues, login security, or token problems.

mitm-find-bizlogic

Find Business Logic vulnerabilities in captured traffic. Use when user asks about payment bypass, race conditions, workflow abuse, or application logic flaws.

mitm-find-callback

Find payment callback and webhook vulnerabilities. Use when user asks about payment security, callback tampering, hash validation, or transaction manipulation.

mitm-find-checksum

Find checksum and signature vulnerabilities. Use when user asks about hash validation, signature bypass, checksum manipulation, or cryptographic weaknesses.

mitm-find-enumerable

Find enumerable endpoints that leak data through iteration. Use when user asks about data scraping, bulk data access, or iterating through records.

mitm-find-idor

Find IDOR (Insecure Direct Object Reference) vulnerabilities in captured traffic. Use when user asks about authorization issues, sequential IDs, or accessing other users' data.

mitm-find-insecure

Find insecure configurations in HTTP traffic. Use when user asks about security headers, cookie security, CORS issues, or transport security.

mitm-find-otp

Find OTP implementation vulnerabilities. Use when user asks about OTP security, verification bypass, SMS security, or two-factor authentication issues.

mitm-find-pii

Find PII (Personally Identifiable Information) leakage in API responses. Use when user asks about data exposure, privacy issues, or sensitive data in traffic.

mitm-find-referer

Find Referer header leakage vulnerabilities. Use when user asks about URL leakage, third-party data exposure, or sensitive data in headers.

mitm-find-secrets

Find leaked secrets, API keys, and credentials in traffic. Use when user asks about exposed keys, hardcoded secrets, or credential leakage.

mitm-find-sqli

Find SQL Injection vulnerabilities in captured traffic. Use when user asks about database security, injection attacks, or data extraction.

mitm-find-ssrf

Find SSRF (Server-Side Request Forgery) vulnerabilities in captured traffic. Use when user asks about URL fetching, webhooks, integrations, or internal network access.

mitm-list-apis

List all APIs from mitmproxy traffic capture. Use when user asks to see APIs, endpoints, or wants an overview of captured HTTP traffic for a website or app.

mitm-report

Generate a security vulnerability report. Use when user asks for a report, summary of findings, or formatted vulnerability documentation.

mitm-security-audit

Comprehensive security audit of mitmproxy traffic. Use when user wants to analyze captured HTTP traffic for vulnerabilities, or mentions pentesting, security testing, or vulnerability assessment.

mitm-subdomains

Enumerate subdomains from captured traffic. Use when user asks about subdomain discovery, attack surface mapping, or domain reconnaissance.