burp-suite
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes shell commands to launch the Burp Suite application using Java, which is expected functionality for this tool.
- Launching the main executable:
burpsuite. - Execution via Java Archive:
java -jar /path/to/burpsuite.jar --project-file=contoso.burp. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface because it is designed to ingest and analyze untrusted data from external web applications and APIs during security testing.
- Ingestion points: HTTP requests and responses from target web applications as described in the 'Procedure' section of SKILL.md.
- Boundary markers: The instructions do not define specific delimiters or instructions to separate untrusted web content from the agent's core instructions.
- Capability inventory: The agent has access to the shell to execute Burp Suite commands and potentially interact with the file system via project files.
- Sanitization: There are no instructions for sanitizing or filtering the content retrieved from web servers before the agent processes it for reporting or analysis.
Audit Metadata