Versioned security assessment

Report ID: SA-6425EC35

7/5/2026, 10:23:47 PM

burp-suite-testing security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
burp-suite-testing
Version
v3
Maintainer
sickn33
Source
github.com/sickn33/antigravity-awesome-skills/tree/main/skills/burp-suite-testing
Coverage
1 Files scanned · 386 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

6 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static backtick and network detections are markdown examples or local Burp proxy references, so they are false positives for local execution or exfiltration. The skill still contains actionable web exploitation workflows, including price manipulation, authentication bypass, credential attacks, and command or file access payloads. Publication should require stronger authorization boundaries and lab-only framing.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 386 Lines analyzed

10 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 22 evidence locations

Capability review items (4)
High
SKILL.md:275-293
Ruby/shell backtick execution
```
This payload block includes command-injection examples such as listing files and reading password files on a target. It is not local Ruby execution, but it is actionable external command payload guidance.
High
SKILL.md:293-294
Ruby/shell backtick execution
`whoami`
The backticked whoami payload is presented as a command-injection test. It can reveal execution context on a target system if used against a vulnerable application.
High
SKILL.md:287
Path traversal sequence
../../../etc/passwd
The payload is an actionable path traversal string targeting Unix password files on a web target. Even in testing context, it can be used to attempt sensitive file disclosure.
High
SKILL.md:288
Path traversal sequence
..\..\..\..\windows\win.ini
The Windows traversal payload is a direct example for probing file disclosure. It is dual-use security content that can be misused against unauthorized systems.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (6)

RISK-001 Critical
SKILL.md:287
System password file access
../../../etc/passwd
The path traversal payload explicitly targets /etc/passwd. That is sensitive system-file disclosure guidance, even though it is presented as a test payload.
RISK-002 Critical
SKILL.md:292
System password file access
| cat /etc/passwd
The command-injection payload pipes cat /etc/passwd, directly attempting sensitive file disclosure from a target system. This is actionable high-risk exploit guidance.
RISK-003 High
SKILL.md:293
System reconnaissance
`whoami`
whoami is a reconnaissance command in the command-injection payload list. It can disclose the target process identity when a vulnerability exists.
RISK-004 High
SKILL.md:326-334
Actionable Business Logic Abuse Workflow
The examples give step-by-step instructions for manipulating an e-commerce price request and completing checkout at the changed price. This can support authorized testing, but it is directly usable for fraud against real applications.
Lines 326-334 provide an explicit price manipulation scenario through checkout. The broader guardrails do not make this example lab-only.
RISK-005 High
SKILL.md:336-345SKILL.md:276-279
Authentication Bypass And SQL Injection Guidance
The skill shows an authentication bypass test using an SQL injection payload and tells the user to observe successful login. This is actionable exploit guidance for login systems.
The cited lines include concrete SQL injection payloads and an authentication bypass walkthrough. The intent is clear despite the authorized-testing framing.
RISK-006 High
SKILL.md:222-251
Credential Attack Automation Guidance
The Intruder section describes credential testing, username and password payload sets, and attack modes including full combination testing. These steps can enable brute-force or credential stuffing when used without authorization.
The section gives concrete Burp Intruder steps, attack modes, and credential payload sets. It includes legitimate testing uses but remains directly actionable for credential attacks.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Sensitive file and command injection payloads include password-file examples.
    Replace sensitive targets with harmless lab-only placeholders and state that payloads must be used only in controlled labs.
  2. FIX-002
    High
    Actionable offensive testing steps can be misused outside authorized assessments.
    Add explicit refusal guidance for unauthorized targets and require written scope before exploit workflows are used.
  3. FIX-003
    High
    Credential attack and brute-force examples are broadly framed.
    Restrict Intruder guidance to approved test accounts, low payload counts, rate limits, and lockout-safe test plans.
  4. FIX-004
    Medium
    Exploit examples lack repeated scope checks at the point of use.
    Add scope reminders before price manipulation, authentication bypass, command injection, and traversal examples.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable