# Mitm Find Pii

> Find PII (Personally Identifiable Information) leakage in API responses. Use when user asks about data exposure, privacy issues, or sensitive data in traffic.

- Skill: `instavm/mitm-find-pii` (Agent Skill)
- Install (CLI): `npx skillmds@latest add instavm/mitm-find-pii`
- Raw SKILL.md: https://api.skillmd.com/api/skills/instavm/mitm-find-pii/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: instavm (https://skillmd.com/u/instavm)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/instavm/mitm-find-pii

---


# Find PII Leakage

Analyze the mitmproxy dump (log.txt) for PII exposure for: $ARGUMENTS

> **Requires**: `log.txt` in the current directory. If it's missing, capture traffic first:
> ```bash
> mitmdump --set flow_detail=3 2>&1 | tee log.txt
> ```

## PII Categories to Check

### 1. Contact Information
- Email addresses in responses
- Phone numbers (full or partial)
- Physical addresses

### 2. Financial Data
- Credit card numbers (even partial)
- Bank account details
- Transaction amounts
- Payment tokens

### 3. Identity Information
- Full names
- Date of birth
- Gender
- PAN/SSN/ID numbers

### 4. Authentication Data
- Passwords (plain or hashed)
- OTPs in responses
- Session tokens
- API keys

### 5. Behavioral Data
- Purchase history
- Browsing patterns
- Location data (lat/long)

## Red Flags

- PII returned without authentication
- PII in error responses
- PII leaked to third-party domains
- PII in GET parameters (logged in server logs)
- Unmasked data where masking expected

## Output Format

For each finding:
- **Endpoint**: Where PII is exposed
- **Data Type**: What PII is leaked
- **Sample**: Redacted example
- **Context**: Authenticated/Unauthenticated
- **Severity**: Based on sensitivity
- **Fix**: Mask, remove, or restrict access