api-mitmproxy

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill includes scripts and commands that capture and log authentication tokens and message contents (printing token substrings and message payloads) and shows examples of embedding tokens in command arguments, which requires handling and outputting secret values.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The list includes an untrusted raw GitHub-hosted shell installer (https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh) which is piped to bash in the CI template — a high-risk supply-chain pattern that can execute remote code and is commonly used to deliver malware.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content includes several high-risk, abuse-enabling instructions: a CI pipeline piping an unverified remote installer to bash (supply‑chain RCE), exposing the proxy on 0.0.0.0 (remote interception/backdoor risk), explicit code that captures and prints authorization tokens (credential theft/logging), SSL‑pinning bypass commands (enables unauthorized interception), and destructive certificate reset (unsafe filesystem operation).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.99). The CI job in assets/ci-config-template.yml fetches and pipes https://raw.githubusercontent.com/aquasecurity/tfsec/master/scripts/install_linux.sh directly into bash at runtime, which executes remote code and creates a required, mutable external dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs modifying host system/network configuration (e.g., editing /etc/hosts, applying iptables/pf rules) and installing system CA certificates, all of which change the machine state and typically require elevated privileges.