The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes a local wrapper script (burp-search.sh) using the Bash tool to execute Java commands for parsing project data. This behavior is consistent with its stated utility and is triggered only by user-initiated searches.\n- [EXTERNAL_DOWNLOADS]: Instructions direct users to manually download necessary tools from PortSwigger and a community GitHub repository (BuffaloWill/burpsuite-project-file-parser). These are documented as setup prerequisites and do not involve automated execution or unverified remote scripts.\n- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection because it ingests untrusted data from captured HTTP traffic within .burp files (specifically in proxy history and site maps). The skill mitigates this attack surface by enforcing a mandatory evidence chain: it requires checking record size before retrieval, mandates truncation of all body content to 1000 characters, and uses jq to ensure data remains within a structured schema. These controls effectively limit the potential for malicious content in captured traffic to influence agent behavior.

burpsuite-project-parser