Agent skill · security · aiskillstore
api-mitmproxy
Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes Python scripting API for automation and multiple interfaces (console, web, CLI). Use when: (1) Intercepting and analyzing API traffic for security testing, (2) Modifying HTTP/HTTPS requests and responses to test API behavior, (3) Recording and replaying API traffic for testing, (4) Debugging mobile app or thick client API communications, (5) Automating API security tests with Python scripts, (6) Exporting traffic in HAR format for analysis.
Why this skill is useful
Adds executable Python scripts for automated API security testing and traffic manipulation that extend the AI's capabilities.
What it needs
Requires mitmdump, mitmproxy, mitmweb, python installed locally. About 7k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
mitmproxy API Security Testing Overview mitmproxy is an interactive, TLS-capable intercepting HTTP proxy for penetration testers and developers. It enables real-time inspection, modification, and replay of HTTP/HTTPS traffic including APIs, mobile apps, and thick clients. With support for HTTP/1, HTTP/2, HTTP/3, and WebSockets, mitmproxy provides comprehensive coverage for modern API security testing. Interfaces mitmproxy - Interactive console interface with keyboard navigation mitmweb - Web-based GUI for visual traffic inspection mitmdump - Command-line tool for automated traffic capture and scripting Quick Start Install and run mitmproxy: Configure client to use proxy (default: localhost:8080) Core Workflows Workflow 1: Interactive API Traffic Inspection For manual API security testing and analysis: 1. Start mitmproxy or mitmweb: 2. Configure target application to use proxy (HTTP: localhost:8080) 3. Install mitmproxy CA certificate on client device 4. Trigger API requests from the application 5. Intercept and inspect requests/responses in mitmproxy 6. Modify requests to test: Authentication bypass attempts Authorization flaws (IDOR, privilege escalation) Input validation (SQLi, XSS, command injection) Business logic vulnerabilities 7. Save flows for documentation and reporting Workflow 2: Mobile App API Security Testing Progress: [ ] 1. Install mitmproxy CA certificate on mobile device [ ] 2. Configure device WiFi to use mitmproxy as proxy [ ] 3. Start mitmweb for visual traffic inspection [ ] 4. Launch mobile app and exercise all features [ ] 5. Review API endpoints, authentication mechanisms, data flows [ ] 6. Test for common API vulnerabilities (OWASP API Top 10) [ ] 7. Export traffic as HAR for further analysis [ ] 8. Document findings with request/response examples Work through each step systematically. Check off completed items. Workflow 3: Automated API Traffic Recording For capturing and analyzing API traffic at scale: 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/api-mitmproxy