Pentest with Burp Mcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent penetration-testing assistant, but it includes unsafe evidence-handling and TLS-bypass instructions that users should review before installing.

Install only for authorized penetration tests, preferably in an isolated browser profile and test environment. Before use, require redaction of cookies, tokens, passwords, personal data, keys, IVs, and sensitive response bodies; avoid global TLS verification bypass unless the target certificate is verified out of band and the browser profile is disposable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:127

Finding

Global TLS Certificate Validation Bypass

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127-131
Vulnerability Type: Global certificate verification bypass
Risk Level: High

Vulnerable Code Snippet

markdown

### Handling HTTPS Certificate Errors

When a certificate error page is encountered, handle it in the following priority order:

**Chrome certificate-error bypass startup parameter**
- Restart Chrome DevTools MCP with the `--ignore-certificate-errors` parameter
- Automatically ignore all certificate errors and attempt to continue accessing the target

The excerpt is an English rendering of the corresponding source instructions.

Technical Analysis

The Skill instructs Chrome DevTools MCP to restart Chrome with --ignore-certificate-errors. This option globally disables certificate verification for the affected browser process rather than trusting a specific certificate or test certificate authority.

Penetration testing legitimately may involve targets with self-signed certificates. However, globally accepting every invalid certificate exceeds the minimum privilege necessary for that purpose. It removes protection against expired, mismatched, untrusted, and attacker-generated certificates across every origin accessed by the browser process.

The browser may handle test credentials, session cookies, bearer tokens, form contents, vulnerability evidence, and application responses. With certificate verification disabled, a network-positioned attacker can impersonate an HTTPS target and intercept or modify that information.

Attack Path

1. The tester encounters a certificate warning on an authorized target.
2. The Skill directs the tester or agent to restart Chrome with --ignore-certificate-errors.
3. An attacker gains control of, or is already positioned on, the network path through a malicious access point, compromised proxy, DNS manipulation, or routing attack.
4. The attacker presents an arbitrary TLS certificate ...[truncated 966 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not launch a general-purpose browser process with --ignore-certificate-errors.
2. Import and trust only the authorized target's test certificate or private test CA.
3. Scope any unavoidable exception to the explicitly authorized hostname and test session.
4. Use a dedicated, isolated browser profile that contains no unrelated cookies, credentials, or browsing state.
5. Require explicit user confirmation before proceeding with an invalid certificate.
6. Display the certificate fingerprint and require it to match an out-of-band value supplied by the target owner.
7. Prohibit entry of credentials or sensitive data while certificate authenticity remains unverified.
8. Terminate the isolated browser after testing and remove temporary trust settings.

T09 · Insecure Skill Coding Practices

Error

• Location: templates/report_templates.md:31

Finding

Unredacted Sensitive Data Required in Persistent Penetration-Test Reports

Content

View full analysis

Vulnerability Details

File Locations: templates/report_templates.md, lines 31-40, 65-69, and 85-95; supporting workflow instructions in SKILL.md, lines 20-21 and 49-52
Vulnerability Type: Plaintext storage of credentials, tokens, cryptographic material, and sensitive responses
Risk Level: High

Vulnerable Code Snippet

markdown

### Vulnerability X: [Vulnerability Name]
- **Severity**: Critical / High / Medium / Low
- **CWE**: [CWE identifier and name]
- **CVSS**: [Score]
- **Endpoint**: [Affected URL]
- **Parameter**: [Affected parameter]

#### Reproduction Steps
1. ...

#### PoC Request
(Complete HTTP request, ensuring direct reproducibility)

## 2. Key Extraction
- **Key**: `[extracted string]`
- **IV**: `[extracted string]`
- **Generation Logic**: [Static hardcoded / dynamically delivered]

# Complete PoCs for All Unauthorized Endpoints

> Target: [URL]
> Test Time: [Date]
> Total: X PoCs

## POC-XX [Vulnerability Name]
(Complete HTTP request and actual response)
(Mark as: HTTP 200 / unauthenticated but blocked by another constraint / information disclosure)

## Quick curl Verification Scripts
(One-command reproducible curl command collection)

The excerpt is an English rendering of the corresponding source template.

Supporting workflow instructions direct the agent to extract keys, enter account credentials, observe requests and responses, create pentest_report.md when testing starts, and append every newly discovered vulnerability to that file.

Technical Analysis

Complete HTTP requests frequently contain sensitive headers and values, including:

• Authorization bearer tokens.
• Session cookies and CSRF tokens.
• Basic-auth credentials.
• API keys and signed request parameters.
• Passwords and personal information in request bodies.

Actual responses may contain customer records, internal identifiers, password-reset links, access tokens, sta ...[truncated 2331 chars]

Remediation

View remediation

Remediation Suggestions

1. Redact Authorization, Cookie, Set-Cookie, proxy authorization, API-key, password, and token fields by default.
2. Replace live values with clearly marked placeholders such as REDACTED_TOKEN or TEST_SESSION_COOKIE.
3. Include only the minimum request and response fragments necessary to demonstrate each finding.
4. Mask personal and customer data, retaining only synthetic or non-sensitive examples.
5. Do not place operational cryptographic keys or initialization vectors in the main report. Record fingerprints or partially masked values instead.
6. Generate curl examples with placeholders and require users to supply short-lived test credentials separately.
7. Store indispensable raw evidence in a separate encrypted evidence archive with role-based access controls and audit logging.
8. Create report files with restrictive permissions, such as owner-only read and write access.
9. Define retention periods and securely delete raw evidence after remediation verification and contractual retention requirements are satisfied.
10. Add an automated sanitization pass that detects tokens, cookies, passwords, private keys, and personal data before reports are saved or exported.
11. Prefer dedicated, least-privileged, short-lived test accounts and revoke all test credentials after the engagement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template requests direct inclusion of extracted cryptographic keys and IVs, which are highly sensitive secrets that can enable decryption, traffic interception, impersonation, or further compromise if exposed. In the context of a pentest skill, users are especially likely to handle live production secrets, making disclosure materially dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and the full instructional content are written entirely in Chinese, and the skill does not indicate that language choice is optional or user-selectable. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s instructional text is entirely in Chinese, including the title and usage guidance, with no indication that language selection is optional or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The template explicitly asks for complete reproducible HTTP requests and responses, which commonly include session cookies, bearer tokens, API keys, personal data, and internal identifiers. In a penetration-testing skill, this creates a real risk of propagating sensitive secrets into reports, logs, prompts, or downstream systems without any sanitization guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A complete mitmproxy decrypt/re-encrypt script can process live user traffic and embedded credentials, cookies, tokens, and payloads, but the template provides no warning about privacy, authorization, or safe data handling. That omission increases the chance that analysts will capture, store, or share sensitive intercepted traffic unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The POC collection template asks for complete unauthorized endpoint requests and actual responses, which can expose sensitive data, authentication artifacts, internal routes, or exploit details that facilitate misuse. Because the skill is specifically for offensive security workflows, this materially increases the likelihood of over-collection and unsafe dissemination.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The natural-language instructions and templates are presented only in Chinese, which can amount to a language policy constraint if users are not given a choice or told that the skill is intended for a Chinese-speaking context. The file does not provide any opt-in or justification for limiting content to a specific language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.