burpsuite-project-parser

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub link points to a third‑party personal repository that distributes a downloadable extension/JAR (an executable artifact) from an individual account — a common vector for malware — while the PortSwigger link is the official vendor page and not suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow runs scripts/burp-search.sh on a user-supplied Burp .burp project file and delegates parsing to the burpsuite-project-file-parser extension, which will read outsider-authored HTTP response/request text from that project and emit it as JSON lines into the agent’s LLM context (indirect prompt injection via captured traffic/body/header content).