📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills burp-suite-testing
📦
burp-suite-testing
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Test Web Apps with Burp Suite
Web teams need a repeatable way to inspect and test application traffic. This skill guides authorized Burp Suite workflows for interception, replay, scanning, and findings review.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "burp-suite-testing" from https://skillstore.io/skills/sickn33-burp-suite-testing.md and its manifest at https://skillstore.io/api/skills/sickn33-burp-suite-testing/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "burp-suite-testing". I need to test an authorized checkout flow in staging.
Expected outcome:
- Confirm written scope and use a test account.
- Capture the checkout request in Proxy.
- Replay controlled changes in Repeater.
- Record whether server-side validation blocks unsafe values.
Using "burp-suite-testing". A scan reported a possible reflected script issue.
Expected outcome:
- Open the triggering request and response.
- Repeat the request with a harmless validation marker.
- Compare response behavior and browser execution evidence.
- Document impact, affected parameter, and remediation advice.
Using "burp-suite-testing". Browser traffic is not appearing in Burp.
Expected outcome:
- Check that the local listener is active.
- Verify browser proxy settings.
- Confirm the Burp certificate is trusted for HTTPS.
- Review intercept rules and target protocol support.
Security Audit
Criticalv4 • 7/5/2026 Open versioned report
Most static backtick and network detections are markdown examples or local Burp proxy references, so they are false positives for local execution or exfiltration. The skill still contains actionable web exploitation workflows, including price manipulation, authentication bypass, credential attacks, and command or file access payloads. Publication should require stronger authorization boundaries and lab-only framing.
1
Files scanned
386
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (6)
Critical
System password file access
../../../etc/passwd
The path traversal payload explicitly targets /etc/passwd. That is sensitive system-file disclosure guidance, even though it is presented as a test payload.
Critical
System password file access
| cat /etc/passwd
The command-injection payload pipes cat /etc/passwd, directly attempting sensitive file disclosure from a target system. This is actionable high-risk exploit guidance.
High
System reconnaissance
`whoami`
whoami is a reconnaissance command in the command-injection payload list. It can disclose the target process identity when a vulnerability exists.
High
Actionable Business Logic Abuse Workflow
The examples give step-by-step instructions for manipulating an e-commerce price request and completing checkout at the changed price. This can support authorized testing, but it is directly usable for fraud against real applications.
Lines 326-334 provide an explicit price manipulation scenario through checkout. The broader guardrails do not make this example lab-only.
High
Authentication Bypass And SQL Injection Guidance
The skill shows an authentication bypass test using an SQL injection payload and tells the user to observe successful login. This is actionable exploit guidance for login systems.
The cited lines include concrete SQL injection payloads and an authentication bypass walkthrough. The intent is clear despite the authorized-testing framing.
High
Credential Attack Automation Guidance
The Intruder section describes credential testing, username and password payload sets, and attack modes including full combination testing. These steps can enable brute-force or credential stuffing when used without authorization.
The section gives concrete Burp Intruder steps, attack modes, and credential payload sets. It includes legitimate testing uses but remains directly actionable for credential attacks.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
```
This payload block includes command-injection examples such as listing files and reading password files on a target. It is not local Ruby execution, but it is actionable external command payload guidance.
High
Ruby/shell backtick execution
`whoami`
The backticked whoami payload is presented as a command-injection test. It can reveal execution context on a target system if used against a vulnerable application.
High
Path traversal sequence
../../../etc/passwd
The payload is an actionable path traversal string targeting Unix password files on a web target. Even in testing context, it can be used to attempt sensitive file disclosure.
High
Path traversal sequence
..\..\..\..\windows\win.ini
The Windows traversal payload is a direct example for probing file disclosure. It is dual-use security content that can be misused against unauthorized systems.
Risk Factors
⚙️ External commands (22)
SKILL.md:63-68 SKILL.md:68-102 SKILL.md:102-103 SKILL.md:103-104 SKILL.md:104-105 SKILL.md:105-109 SKILL.md:109-118 SKILL.md:118-157 SKILL.md:157-163 SKILL.md:163-167 SKILL.md:167-175 SKILL.md:175-243 SKILL.md:243-252 SKILL.md:252-275 SKILL.md:275-293 SKILL.md:293-294 SKILL.md:294-329 SKILL.md:329-330 SKILL.md:330-342 SKILL.md:342-351 SKILL.md:351-353 SKILL.md:353
🌐 Network access (3)
📁 Filesystem access (2)
Detected Patterns
System password file access×2System reconnaissance
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-burp-suite-testing/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-burp-suite-testing?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-burp-suite-testing?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-burp-suite-testing/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-burp-suite-testing.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). burp-suite-testing security audit report (audit version 4) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-burp-suite-testing/audits/4BibTeX citation
@techreport{sickn33-sickn33-burp-suite-testing-2026,
author = {sickn33},
title = {burp-suite-testing security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/sickn33-burp-suite-testing/audits/4},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "burp-suite-testing security audit report (audit version 4)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/sickn33-burp-suite-testing/audits/4"
identifiers:
- type: other
value: "skillstore:sickn33-burp-suite-testing:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
85
Content
69
Community
83
Spec Compliance
What You Can Build
Validate Staging Traffic
Inspect requests and responses for a staging application before release.
Run Authorized Assessments
Structure manual Burp testing across scope, Repeater, Intruder, and reporting.
Review Scanner Findings
Use Burp Professional results as starting points for manual validation.
Try These Prompts
Set Up Burp Proxy
I have permission to test a staging web app. Guide me through setting up Burp Suite proxy and browser interception.
Inspect A Request
Help me capture one in-scope HTTP request, review headers and parameters, and decide what to send to Repeater.
Plan Scanner Review
Create an authorized Burp Professional scan plan for my target scope, including scan mode, rate limits, and manual validation steps.
Build A Test Strategy
Design a scoped Burp Suite testing workflow for authentication, access control, and input validation. Include evidence to collect and reporting notes.
Best Practices
- Confirm written authorization before testing any target.
- Set target scope before scanning or sending repeated requests.
- Validate automated results manually before reporting vulnerabilities.
Avoid
- Testing systems without permission.
- Running heavy scans without rate limits or maintenance windows.
- Treating scanner output as final evidence without manual review.
Frequently Asked Questions
Do I need Burp Suite installed?
Yes. The skill explains workflows, but it does not install or run Burp Suite for you.
Can I use Community Edition?
Yes. Proxy and Repeater workflows work in Community Edition. Automated scanning requires Professional.
Does this skill confirm authorization?
No. Users must confirm written permission and scope before testing any system.
Can it help with HTTPS interception?
Yes. It explains certificate setup at a high level and common troubleshooting checks.
What outputs should I expect?
Expect testing steps, traffic review guidance, scan review notes, and report-ready finding summaries.
Is it suitable for production targets?
Only with authorization, agreed scope, and rate limits. Use a staging environment when possible.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/burp-suite-testingRef
6425ec35f4ac137735cff58cd7877843bba23e3b
Maintenance freshness
7/18/2026
Usage
6 downloads · 110 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-fullstack
82Build Fullstack Apps with Senior Patterns
Teams need consistent setup, architecture, and review guidance for modern web applications. This skill provides scaffolders, workflow references, and quality prompts for React, Next.js, Node.js, GraphQL, and PostgreSQL projects.
Coding & Development View
📦
senior-architect
81Design Scalable Software Architectures
Architecture decisions are hard to compare across web, mobile, backend, and cloud systems. This skill provides structured guides and local scaffold scripts for reports, dependency review, and trade-off documentation.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
exploitation-knowledge
38Assess Exploitation Techniques and Shell Access
by CharlesKozel
Security teams need a structured way to review exploit workflows and understand operational risk. This skill organizes exploitation methods, payload choices, and post-access checks for controlled lab or audit review.
Security & Compliance View
📦
webapp-sqlmap
38Assess SQL Injection with SQLMap
by AgentSecOps
Manual SQL injection testing is slow and inconsistent. This skill provides structured SQLMap commands, authorization checks, validation steps, and reporting guidance for approved assessments.
Security & Compliance View
📦
python-web-app-security-audit
90Audit Python Web Apps Before Release
by glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Security & Compliance View
📦
senior-security
81Strengthen Application Security Reviews
by alirezarezvani
Security reviews often lack consistent checklists and reusable workflows. This skill provides security review scaffolds, reference guidance, and simple reporting scripts for Claude, Codex, and Claude Code.
Security & Compliance View
📦
security-analyzer
80Analyze Project Security Risks
by Cornjebus
Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.
Security & Compliance View
📦
security-sentinel
79Audit Code for Security Risks
by Barnhardt-Enterprises-Inc
Security-sensitive code is easy to ship with hidden flaws in authentication, input handling, and secrets. This skill gives Claude, Codex, and Claude Code structured security references and scanner guidance for safer reviews.
Security & Compliance View