xss-testing-burpsuite
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation suggests installing the Dalfox XSS scanner via the command line using
go install github.com/hahwul/dalfox/v2@latestfor automated scanning activities.\n- [EXTERNAL_DOWNLOADS]: The skill references external security tools and libraries, including Burp Suite extensions (Hackvertor, XSS Validator) and the html2canvas library, to facilitate testing and documentation of findings.\n- [INDIRECT_PROMPT_INJECTION]: The companion scriptscripts/agent.pyrepresents a potential attack surface by ingesting and processing untrusted HTML content from target websites to identify reflection points and injection vectors.\n - Ingestion points: The
find_reflection_pointsandfuzz_xss_payloadsfunctions inscripts/agent.pycrawl and fetch HTML content from user-provided target URLs at runtime.\n - Boundary markers: The script does not implement specific boundary markers or delimiters when handling external web content fetched via the requests library.\n
- Capability inventory: The script is capable of making network requests (
requests.get,requests.post) and writing report files to the local file system.\n - Sanitization: The script performs no sanitization of the fetched HTML content, as its primary purpose is to identify the verbatim reflection of test payloads in the server response.
Audit Metadata