burpsuite-project-parser

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a wrapper script (burp-search.sh) and interact with the Java-based Burp Suite Professional executable for project parsing.
  • [EXTERNAL_DOWNLOADS]: The documentation instructs the user to manually download and install a JAR file from an external third-party repository (github.com/BuffaloWill/burpsuite-project-file-parser) to enable CLI functionality.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it processes untrusted HTTP traffic data contained within Burp project files.
  • Ingestion points: Data enters the agent context through the parsing of .burp files via the burp-search.sh script referenced in SKILL.md.
  • Boundary markers: The skill explicitly defines safety boundaries, such as mandatory output truncation using head -c 50000 and jq to limit response body fields to 1000 characters.
  • Capability inventory: The skill has the capability to execute shell commands and file read operations using the Bash and Read tools.
  • Sanitization: It relies on user-invoked jq filters and manual truncation commands to manage and sanitize the output from external files before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 12:36 PM
Security Audit — agent-trust-hub — burpsuite-project-parser