gabrielmoreira/agent-skills-mirror/traffic-capture

When to Use

• Changing how the proxy forwards, captures, ingests, or replays traffic.

The one-line "route every egress through the guard" rule is in the capture_proxy AGENTS.md CRITICAL RULES; this skill is the mechanism.

Critical Rules

• NEVER match the internal denylist on the hostname alone. The guard denies

on the resolved IP (RFC1918 and friends), because a hostname that resolves to an internal address (or re-resolves after a check) is the SSRF/DNS-rebinding case. See scanners/capture_proxy/egress.py (the block conditions operate on the resolved IP).

• **NEVER build a replay/fuzz target from unvalidated LLM output and send it

straight out.** The replay path is a new egress path; it must pass the same EgressPolicy guard as captured traffic, or the agent can be steered into an internal pivot. Args must not reach the wire un-guarded.

• NEVER remove a block condition to "make replay work". Each condition is

individually toggleable via EgressPolicy (surfaced in settings); loosen it there, per-condition, not by deleting the check.

• ALWAYS keep capture and ingest off the scan's critical path. Capture writes

an append-only spool; a separate worker tails it into Postgres (scanners/capture_proxy/ingest_worker.py). That decoupling is deliberate - capture must never block or slow the scan it observes.

The capture pipeline

Commands

docker compose --profile capture build capture-proxy  # image rebuild (Dockerfile change, or a change to
                                                      # recon_orchestrator/hard_guardrail.py, which it bundles)
./redamon.sh test unit                                # capture_proxy section

A build alone does not swap the running proxy: the orchestrator spawns it, not compose. Stop and start traffic capture once after a rebuild so it is recreated from the new image; that interrupts every session's capture.

Resources

• docs/readmes/README.TRAFFIC.md - capture/replay/fuzz architecture and settings
• Related: capture_proxy AGENTS.md CRITICAL RULES (route egress through the guard)