The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Bash script (scripts/burp-search.sh) as a wrapper to execute the Burp Suite JAR file using a local Java installation. It identifies default paths for macOS and Linux and allows users to override these via environment variables.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes untrusted HTTP traffic stored in Burp project files. Malicious content in captured responses could attempt to influence agent behavior.
Ingestion points: Data enters the agent's context through the output of the burp-search.sh script when reading .burp project files.
Boundary markers: The instructions mandate strict output limits using head -c 50000 and require the agent to truncate individual response bodies to 1000 characters using jq filters.
Capability inventory: The skill has access to the Bash tool to execute the search wrapper and post-process results with standard utilities like wc, jq, and grep.
Sanitization: The skill relies on the agent following specific formatting and truncation instructions rather than implementing programmatic sanitization within the search script.

burpsuite-project-parser