Versioned security assessment

Report ID: SA-0D6C3DEC

6/30/2026, 12:45:05 PM

burp-suite-testing security assessment v2

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
burp-suite-testing
Version
v2
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/burp-suite-testing
Coverage
1 Files scanned · 386 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis reported command execution, network, filesystem, password file, and weak cryptography patterns, but the reviewed evidence is Markdown guidance and payload documentation rather than executable skill code. No prompt injection attempt or confirmed malicious host-side behavior was found. The skill remains medium risk because it provides dual-use Burp Suite exploitation workflows, Intruder attack guidance, and common attack payloads that require strict authorization.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 386 Lines analyzed

6 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 3 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 22 evidence locations

Capability review items (6)
Medium
SKILL.md:15SKILL.md:42-46SKILL.md:88-120SKILL.md:322-345
Dual-Use Web Exploitation Workflow
The skill teaches Burp Suite workflows for vulnerability discovery and exploitation, including request modification, proof-of-concept exploits, SQL injection, and authentication bypass examples. This is legitimate for authorized testing, but it can enable misuse against systems without permission.
The reviewed lines explicitly describe exploitation-oriented Burp Suite testing and proof-of-concept outputs. The skill also includes authorization guardrails, so the concern is dual-use risk rather than confirmed malicious intent.
Medium
SKILL.md:222-252
Automated Intruder Attack Guidance
The Intruder section explains configuring attack types and payload sets, including credential testing examples. These workflows can support authorized fuzzing, but they can also support brute-force or credential attack activity if misused.
The evidence directly covers Intruder attack configuration and sample username and password payloads. Guardrails at lines 305-307 reduce but do not remove misuse potential.
Medium
SKILL.md:273-294
Sensitive File and Command Injection Payload Examples
The quick reference lists path traversal and command injection payloads, including password file paths and shell command examples. They are presented as testing payloads, not executed by the skill, but they are still dual-use attack material.
The lines clearly contain path traversal, password file, and command injection payload strings. Context shows documentation for Burp testing rather than local command execution.
Low
SKILL.md:27SKILL.md:362SKILL.md:368
Local Burp Proxy Network References
The hardcoded IP and URL findings refer to Burp Suite local proxy setup and the local certificate download page. They do not identify outbound exfiltration or unauthorized remote network access.
The IP address is 127.0.0.1 for a local proxy listener, and http://burp is the standard Burp local certificate endpoint. No external callback or data transfer logic appears in the skill.
Low
SKILL.md:287SKILL.md:292
System Password File Access Is Documentation Only
The password file strings are included as web security test payloads for path traversal and command injection checks. The skill does not read local system files or instruct the AI agent to access host files.
The strings appear in a common testing payload list under Quick Reference. There is no surrounding code that opens, reads, or transmits local password files.
Low
SKILL.md:23SKILL.md:171SKILL.md:293SKILL.md:307SKILL.md:340
System Reconnaissance Detections Are Contextual
The system reconnaissance hits are references to credentials, test parameters, rate limits, and a command injection payload. They do not instruct the agent to enumerate the local host or collect system data.
The cited lines are prerequisites, Burp test examples, or safety guidance. Only line 293 contains a reconnaissance command string, and it appears inside a web command injection payload list.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Static false positives ignored (2)
Low
SKILL.md:63SKILL.md:68SKILL.md:102SKILL.md:103SKILL.md:104SKILL.md:105SKILL.md:109SKILL.md:118SKILL.md:157SKILL.md:163SKILL.md:167SKILL.md:175SKILL.md:243SKILL.md:252SKILL.md:275SKILL.md:293SKILL.md:294SKILL.md:329SKILL.md:330SKILL.md:342SKILL.md:351SKILL.md:353
External Command Static Hits Are Markdown Syntax
The Ruby or shell backtick detections occur in Markdown code fences, inline formatting, HTTP examples, and payload examples. No executable script invokes these commands from the skill file.
All cited locations are inside SKILL.md documentation and formatting. I found no evidence of runnable Ruby, shell backtick execution, or command dispatch logic.
Low
SKILL.md:3SKILL.md:198SKILL.md:218SKILL.md:234SKILL.md:385
Weak Cryptography Detections Are Substring False Positives
The weak cryptography static hits align with ordinary prose and table text, not with cryptographic API usage. No MD5, DES, SHA-1, or similar implementation was found in the reviewed skill content.
The cited lines are metadata, headings, tables, or prose. I found no evidence of cryptographic operations or instructions to use weak algorithms.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable