burp

SUSPICIOUS. The skill’s purpose and capabilities are internally aligned for web security testing, but its trust boundary is weak: the exact `burp-agent` component is unverified, the Burp-MCP ecosystem includes third-party tooling, and the workflow handles highly sensitive intercepted traffic that may be forwarded beyond localhost depending on configuration. High security risk due to offensive capability and possible credential/data exposure, but not confirmed malware from the provided text alone.