mcpField
M
mitm-find-pii

mitm-find-pii

github.com/instavmSecurity8772 installsUpdated 13w ago
Repository

About mitm-find-pii

mitm-find-pii is a security skill for checking mitmproxy traffic logs for personal data exposure. It examines sensitive data categories and disclosure contexts, then records severity and remediation guidance for findings.

Key features

  1. 01Check contact, financial, and identity data
  2. 02Check authentication and behavioral data
  3. 03Identify exposure in unauthenticated and error responses
  4. 04Record samples, severity, and remediation guidance

Use cases

  1. 01Review API responses for personal data
  2. 02Check data exposure in errors or to third-party domains

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/instavm/security-skills --skill mitm-find-pii

After installing, type/mitm-find-piiin Claude Code to confirm it loaded.

Details

From the project README

Find PII Leakage

Analyze the mitmproxy dump (log.txt) for PII exposure for: $ARGUMENTS

Requires: log.txt in the current directory. If it's missing, capture traffic first:

mitmdump --set flow_detail=3 2>&1 | tee log.txt

PII Categories to Check

1. Contact Information
  • Email addresses in responses
  • Phone numbers (full or partial)
  • Physical addresses
2. Financial Data
  • Credit card numbers (even partial)
  • Bank account details
  • Transaction amounts
  • Payment tokens
3. Identity Information
  • Full names
  • Date of birth
  • Gender
  • PAN/SSN/ID numbers
4. Authentication Data
  • Passwords (plain or hashed)
  • OTPs in responses
  • Session tokens
  • API keys
5. Behavioral Data
  • Purchase history
  • Browsing patterns
  • Location data (lat/long)

Red Flags

  • PII returned without authentication
  • PII in error responses
  • PII leaked to third-party domains
  • PII in GET parameters (logged in server logs)
  • Unmasked data where masking expected

Output Format

For each finding:

  • Endpoint: Where PII is exposed
  • Data Type: What PII is leaked
  • Sample: Redacted example
  • Context: Authenticated/Unauthenticated
  • Severity: Based on sensitivity
  • Fix: Mask, remove, or restrict access

Comments

Markdown supported