burp-mcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:18 AM UTC
• Version: 0.1.0

Overview

This skill appears to do what it says, but it gives an agent broad access to sensitive Burp Suite data and mutation-capable tools without strong guardrails.

Install only if you intentionally want an agent to interact with your local Burp Suite session. Treat outputs as sensitive security data, avoid running broad history queries unless needed, and require explicit human approval before calling mutation tools or using a non-default endpoint. Prefer a pinned mcp dependency and a loopback-only config before routine use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned MCP Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"requires":{"bins":["python"]},"os":["win32","linux","darwin"],"install":[{"id":"python-mcp","kind":"pip","package":"mcp","label":"Install the official Python MCP SDK"}],"configPaths.optional":["./skills/burp-mcp/config.json"]}} ``` ### Technical Analysis The installation metadata specifies the Python `mcp` package without an exact version or integrity hash. Consequently, installing the Skill at different times may retrieve different dependency code from the configured package repository. This prevents reproducible installation and makes the reviewed Skill dependent on the security of future package releases and the package distribution channel. The audit found no evidence that the currently referenced package is malicious; the issue is the absence of controls ensuring that the installed package is the same version that was reviewed. ### Attack Path 1. An attacker compromises the dependency publisher, package repository, or a future package release. 2. The attacker publishes a malicious or compromised version under the expected `mcp` package name. 3. A user installs the Skill, and the installer resolves `mcp` to that mutable version. 4. `scripts/burp_mcp.py` imports modules from the installed package. 5. Malicious package code executes with the privileges of the user running the Skill. ### Impact Assessment Successful exploitation could provide arbitrary Python code execution under the installing or invoking user's account. The resulting scope could include access to files, environment variables, network resources, and Burp-related data available to that user. No privilege escalation beyond the invoking user's existing permissions is demonstrated by the audited project.
• Remediation: ## Remediation Suggestions - Pin `mcp` to an exact, reviewed version rather than using an unconstrained package name. - Maintain a lock file containing cryptographic hashes for all direct and transitive dependencies. - Require hash-verified installation, such as pip's `--require-hashes` mode. - Install packages only from an explicitly configured and trusted package index. - Use an isolated virtual environment with the minimum necessary permissions. - Add automated dependency vulnerability and provenance checks to the release process. - Review and deliberately update the pinned dependency rather than resolving new releases automatically.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/burp_mcp.py:12
• Finding: Configurable MCP Endpoint Does Not Enforce the Documented Localhost Trust Boundary## Vulnerability Details **File Location**: `scripts/burp_mcp.py`, lines 12-20 and 43-45 **Vulnerability Type**: Unvalidated network endpoint configuration **Risk Level**: Low ### Vulnerable Code ```python def get_sse_url() -> str: if os.path.exists(CONFIG_PATH): try: with open(CONFIG_PATH, "r", encoding="utf-8") as f: cfg = json.load(f) if isinstance(cfg, dict) and isinstance(cfg.get("sse_url"), str) and cfg["sse_url"].strip(): return cfg["sse_url"].strip() except Exception: pass return DEFAULT_SSE_URL ``` ```python async def open_session(): sse_url = get_sse_url() streams_cm = sse_client(sse_url) ``` ### Technical Analysis The Skill is documented as connecting to a local Burp MCP server, and the committed configuration safely uses `http://127.0.0.1:9876/`. However, `get_sse_url()` accepts any non-empty string without validating its scheme, hostname, port, or loopback status. `open_session()` then supplies that value directly to the MCP SSE client. A modified configuration can therefore redirect MCP traffic to an unintended remote endpoint. Because non-TLS HTTP URLs are also accepted, remote traffic may lack transport confidentiality and server authentication. The audit found no malicious endpoint in the committed project; exploitation requires alteration or unsafe deployment-specific configuration of `config.json`. ### Attack Path 1. An attacker or unsafe deployment process changes `config.json` so that `sse_url` points to an attacker-controlled endpoint. 2. A user or agent invokes `list-tools` or `call`. 3. The script accepts the endpoint without checking that it resolves to a loopback address. 4. The MCP client establishes a session with the attacker-controlled server. 5. For a tool call, the remote server receives the selected tool name and supplied arguments. 6. The server can return decep ...[truncated 724 chars]
• Remediation: ## Remediation Suggestions - Parse the endpoint with a standard URL parser and reject malformed URLs. - Enforce loopback destinations by default, allowing only `localhost`, `127.0.0.0/8`, and `::1` after hostname resolution. - Protect against DNS rebinding by validating every resolved address and ensuring the connection uses a validated loopback address. - Permit plaintext HTTP only for verified loopback destinations. - If remote endpoints are a required feature, require HTTPS, explicit opt-in, certificate verification, and preferably server authentication or certificate pinning. - Display the resolved destination before connecting and require confirmation when it differs from the default local endpoint. - Fail closed on invalid configuration rather than silently falling back after broad exception handling. - Restrict write access to `config.json` so untrusted local users or processes cannot redirect the client.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes MCP/networked capabilities to a local Burp Suite server but does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens policy enforcement and makes it easier for an agent to invoke broader capabilities than a reviewer might expect, including access to sensitive Burp data or mutation-capable Burp actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documentation encourages connecting to Burp and calling tools, including examples that access proxy history and project options, but it does not prominently warn that these operations can reveal highly sensitive traffic, tokens, cookies, scanner findings, or change Burp settings. In this context, Burp is a security-testing tool that commonly contains confidential application data, so insufficient warning and guardrails materially increase the chance of unsafe use.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

out = {"type": getattr(item, "type", type(item).__name__)}
    for key in ("text", "data", "mimeType", "uri", "annotations", "meta"):
        if hasattr(item, key):
            out[key] = getattr(item, key)
    return out

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:2