intercepting-mobile-traffic-with-burpsuite

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). Provides step-by-step instructions and tooling to intercept mobile app network traffic and explicitly to bypass TLS protections (certificate pinning, installing system CAs, Frida/Objection), a dual-use capability that weakens client-side security and could be misused if applied to unauthorized targets.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/agent.py, the runtime workflow ingests attacker-influenced HTTP request/response free text from Burp exports via the user-supplied HAR file path (--har), parses entries, and scans request/response bodies for patterns (load_har_file, detect_sensitive_data_leakage, check_auth_headers, etc.).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The skill includes explicit, actionable instructions to modify device/system trust stores (adb push to /system/etc/security/cacerts, chmod), use Magisk/Frida to bypass certificate pinning, and manipulate networking (iptables/binding to all interfaces), which require root/sudo or weaken device security and thus push the agent to change machine state and bypass protections.