Versioned security assessment

Report ID: SA-8C339786

2/25/2026, 5:16:17 AM

burp-suite-testing security assessment v1

Skill Security Certification Report

Audit History

Audit model: claude Historical report

Skill name: burp-suite-testing
Version: v1
Maintainer: sickn33
Source: github.com/sickn33/antigravity-awesome-skills/tree/main/skills/burp-suite-testing
Coverage: 1 Files scanned · 386 Lines analyzed
Policy version: Unavailable

Highest confirmed finding severity

Critical

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

This is a legitimate Burp Suite documentation skill for authorized web application security testing. Static findings (external_commands, filesystem, network) are FALSE POSITIVES - they represent example payloads shown in a reference section for educational purposes, not actual executable code. The skill contains proper operational boundaries and best practices. Risk level set to low due to educational nature of payload examples.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 386 Lines analyzed

4 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Binding unavailable
Artifact

Identity incomplete
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 1 evidence location

Capability review items (3)

Critical

SKILL.md:273-294

Example Payloads in Documentation

Static scanner detected command patterns (e.g., 'cat /etc/passwd', 'whoami') and path traversal examples (e.g., '../../../etc/passwd'). These are FALSE POSITIVES - example payloads shown in the 'Common Testing Payloads' reference section (SKILL.md:273-294) for educational purposes. They are markdown text examples, not executable code.

These are clearly documented example payloads in a reference section, not actual code execution. The skill explains these are testing payloads for authorized security testing.

Medium

SKILL.md:27 SKILL.md:362 SKILL.md:368

Legitimate Local Proxy Configuration

Network references to 127.0.0.1:8080 and http://burp are legitimate local proxy configurations for Burp Suite, not external network connections.

These are standard local proxy settings for Burp Suite - 127.0.0.1 is localhost, and http://burp is the local certificate download endpoint.

Low

SKILL.md:1-386

Educational Security Testing Content

The skill provides comprehensive guidance on web application security testing using Burp Suite. All 'dangerous' patterns detected are example payloads in a reference section, which is standard practice for security training materials.

This is legitimate security testing documentation with proper operational boundaries, scope configuration guidance, and best practices for authorized testing.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Critical

Misidentified Weak Cryptographic Algorithm

Static scanner flagged 'weak cryptographic algorithm' at multiple lines (3, 198, 218, 234, 385), but no cryptographic code exists in this skill. This is a FALSE POSITIVE likely caused by the scanner misinterpreting documentation text.

After reviewing the entire skill file, no cryptographic algorithms or implementations exist. The scanner likely misidentified references to security concepts as crypto code.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: Unavailable
Content hash: Unavailable
Tree hash: Unavailable
Skill path: Unavailable
Audit payload hash: Unavailable

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable