deepseek-pentest-ai-burp-extension
Warn
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone a repository from an untrusted GitHub account (github.com/HernanRodriguez1/DeepSeek-Pentest-AI.git).
- [REMOTE_CODE_EXECUTION]: Users are guided to load and execute a script from the untrusted repository as a Burp Suite extension. Burp extensions run with high privileges, allowing them to access system resources, intercept network traffic, and execute commands.
- [INDIRECT_PROMPT_INJECTION]: The extension captures data from external web requests and uses it as context for AI-generated payloads, creating an attack surface where a malicious website could inject instructions into the DeepSeek AI. 1. Ingestion points: Captured GET/POST parameters, JSON/XML bodies, and HTTP headers. 2. Boundary markers: None specified. 3. Capability inventory: Network access to DeepSeek API and fuzzing targets, CSV file generation. 4. Sanitization: Basic redaction of hostnames is mentioned but no specific protections against prompt injection are documented.
Audit Metadata