burpsuite-project-parser
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute a wrapper script (burp-search.sh) and interact with the Java-based Burp Suite Professional executable for project parsing. - [EXTERNAL_DOWNLOADS]: The documentation instructs the user to manually download and install a JAR file from an external third-party repository (
github.com/BuffaloWill/burpsuite-project-file-parser) to enable CLI functionality. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it processes untrusted HTTP traffic data contained within Burp project files.
- Ingestion points: Data enters the agent context through the parsing of
.burpfiles via theburp-search.shscript referenced inSKILL.md. - Boundary markers: The skill explicitly defines safety boundaries, such as mandatory output truncation using
head -c 50000andjqto limit response body fields to 1000 characters. - Capability inventory: The skill has the capability to execute shell commands and file read operations using the
BashandReadtools. - Sanitization: It relies on user-invoked
jqfilters and manual truncation commands to manage and sanitize the output from external files before it is processed by the agent.
Audit Metadata