skills/mukul975/anthropic-cybersecurity-skills/intercepting-mobile-traffic-with-burpsuite/Gen Agent Trust Hub
intercepting-mobile-traffic-with-burpsuite
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's analysis scripts process external data files, creating a potential surface for indirect prompt injection if the output is processed by another LLM step.
- Ingestion points:
scripts/agent.py(load_har_file) andscripts/process.py(parse_burp_xml) read user-provided traffic capture files. - Boundary markers: None.
- Capability inventory: The scripts have file-writing capabilities (
generate_report). - Sanitization: Captured data is not sanitized before being written to reports.
- [PRIVILEGE_ESCALATION]:
SKILL.mddescribes methods for installing CA certificates into the system trust store on rooted Android devices, which involves high-privilege shell commands. These actions are standard for the tool's primary purpose of intercepting encrypted mobile traffic during authorized testing.
Audit Metadata