skills/mukul975/anthropic-cybersecurity-skills/testing-for-xss-vulnerabilities-with-burpsuite/Gen Agent Trust Hub
testing-for-xss-vulnerabilities-with-burpsuite
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation suggests installing the third-party tool
dalfoxfrom a non-predefined trusted repository (github.com/hahwul/dalfox). - [COMMAND_EXECUTION]: The
agent.pyscript automates HTTP request sequences to target applications and intentionally disables SSL certificate verification for penetration testing purposes. - [DATA_EXFILTRATION]: Documentation includes example XSS payloads for exfiltrating sensitive data such as cookies and keystrokes to a demonstration domain (
attacker-server.example.com) to illustrate vulnerability impact. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as the companion script ingests untrusted HTML data from target websites. Ingestion points:
resp.textinscripts/agent.py. Boundary markers: Absent. Capability inventory: Network requests (requests) and local file writing (json.dump). Sanitization: Absent.
Audit Metadata