菜单
Use when explicitly authorized lab traffic must be captured, searched, or exported from the project's mitmproxy-backed Docker lab recorder.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Plan and use user-consented local camera and microphone observations for an explicitly authorized physical target. Use when a capture can establish a bounded physical-state observation such as whether a test fixture changed state, an instrument reading changed, or equipment noise changed relatively.
Use when a network probe, DNS lookup, HTTP fetch, or nmap scan reports the target host or the internet is unreachable. Stops further probing and reports a target-readiness blocker with useful diagnostics.
Safely develop, verify, and document proof-of-concept exploits and payloads for authorized targets inside isolated Workspace Containers. Use when a Hypothesis is well-founded and the user has explicit authorization to test it, needs a minimal PoC, wants to verify impact, or needs to produce reproducible exploit Evidence for a report.
Turn a specific vulnerability, patch, CVE, Version Diff, or Changelog Claim into a proactive security exploration plan. Use when the user wants research angles, lateral target discovery, patch/CVE strategy, new surface discovery, or hypothesis generation from vulnerability intelligence.
Passive, citation-grounded review of security-relevant specifications, protocols, standards, APIs, and implementations. Use when a reviewer must trace external preconditions and invariants into source code without treating a cited claim as proof of a vulnerability.
Scientific model and eval tuning loop for prompt/skill/system-prompt changes, model configuration, runtime options, and local/Ollama model sizing or environment variables. Use when tuning eval performance, comparing local or remote models, improving tool-use behavior, reducing timeouts/loops, or deciding whether an eval optimization is worth keeping.
| name | network-recording |
| description | Use when explicitly authorized lab traffic must be captured, searched, or exported from the project's mitmproxy-backed Docker lab recorder. |
Use this skill only for an explicitly authorized Target and a network-enabled Docker lab. Recording is an observation capability: it does not expand target authorization, allowed methods, redirect scope, or the selected network profile.
Set the lab's Traffic recording option to mitmproxy (or set NETWORK_TRAFFIC_RECORDING_MODE=mitmproxy before the lab starts). The lab is recreated so its HTTP_PROXY, HTTPS_PROXY, and ALL_PROXY point to a per-project mitmproxy sidecar on 127.0.0.1:8080.
The recorder shares the lab's Docker network namespace (network_mode: service:lab is the Compose equivalent), so the existing egress firewall also constrains proxy-originated traffic. Its CA is trusted only inside that project lab. Recording cannot be enabled for offline labs.
Flows are retained in the project Docker volume as /captures/traffic.mitm inside the recorder. They can contain credentials, cookies, request bodies, and response bodies; treat them as sensitive evidence and redact before broader sharing.
Run these commands from the recorder container, substituting its project-specific name from the lab boot log:
# Compact request/response index.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm --set flow_detail=0
# Filter by host, method, status, or URL fragment.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~d target.example'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~m POST'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~s 500'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~u /api/'
# Search decoded request/response content deliberately; this may expose secrets.
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~q token'
docker exec <recorder> mitmdump -nr /captures/traffic.mitm '~b error'
Prefer narrow filters, record the exact command, target, time window, and result count in the evidence artifact. Stop capture when the approved observation is complete; stopping the lab stops its recorder but preserves the flow volume.