Agent skill · security · ghostsecurity
ghost-proxy
Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by method/path/status/host, and inspecting full raw HTTP entries for security analysis. Use when the user asks to "start the proxy", "capture traffic", "intercept requests", "inspect HTTP traffic", "search captured requests", or "view request/response".
Why this skill is useful
Provides specific commands and usage patterns for the Reaper MITM proxy that enhance security analysis capabilities.
What it needs
Requires reaper installed locally. About 3k tokens when loaded. Last updated 2026-03-11. 397 stars on the source repository.
What this skill does
Reaper MITM Proxy Reaper is a CLI-based MITM HTTPS proxy for application security testing. It intercepts, logs, and allows inspection of HTTP/HTTPS traffic flowing through it. Use it to capture live request/response pairs for security validation. Prerequisites Before using any reaper command, make sure the latest version of the binary is installed: All reaper commands in this document should be invoked as ~/.ghost/bin/reaper unless ~/.ghost/bin is on PATH. Quick Reference Command Purpose --------- --------- reaper start --domains example.com Start proxy (foreground) reaper start --domains example.com -d Start proxy (daemon) reaper logs Show recent captured entries reaper search --method POST --path /api/ Search captured traffic reaper get <id> Show full request + response reaper req <id> Show raw HTTP request only reaper res <id> Show raw HTTP response only reaper stop Stop the daemon Starting the Proxy Start reaper scoped to the target domain(s). At least one --domains or --hosts flag is required. Scope behavior: --domains: Suffix match. example.com matches example.com, api.example.com, sub.api.example.com --hosts: Exact match. api.example.com matches only api.example.com Traffic outside scope passes through transparently without logging Routing Traffic Through the Proxy Configure the HTTP client to use the proxy. The default listen address is localhost:8443. The -k / verify=False flag is needed because reaper generates its own CA certificate at startup for MITM TLS interception. Viewing Captured Traffic Recent Entries Output columns: ID, METHOD, HOST, PATH, STATUS, MS, REQ (request body size), RES (response body size). Searching Inspecting Individual Entries Output is raw HTTP/1.1 format including headers and body, suitable for analysis or replay. Stopping the Proxy Common Workflows Validate a Security Finding When used with the validate skill (may need to collaborate with the user to setup the test environment): 1. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills ghostsecurity/proxy