burpsuite-project-parser

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, cli, logs, security, web.

What it does

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill burpsuite-project-parser

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/burpsuite-project-parser/skills/burpsuite-project-parser ~/.claude/skills/burpsuite-project-parser

Safety box score

Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a local wrapper around Burp Suite Professional for searching `.burp` project files and extracting audit items, headers, bodies, and site-map/proxy data. The main risks are that it executes the local Burp/Java toolchain and depends on an external, unreviewed parser extension, while exposing potentially sensitive captured HTTP traffic in its outputs.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	`scripts/burp-search.sh` launches Java and Burp directly: `"$JAVA_PATH" -jar -Djava.awt.headless=true "$BURP_JAR" --project-file="$PROJECT_FILE" "$@"`.
Network access	0 (none)	The shipped files do not make outbound network calls or send data to remote hosts; they only read local files and print results.
Filesystem reach	1 (low)	It reads a user-supplied `.burp` project file and checks external Burp/Java paths such as `/opt/BurpSuiteProfessional/...`, but it does not write or delete files.
Secrets & credentials	2 (moderate)	The skill is meant to extract proxy history, site map data, and response bodies/headers from captured traffic, which can include cookies, tokens, or other sensitive content.
Privilege & persistence	0 (none)	No sudo, service registration, scheduled tasks, or shell/OS setting changes are performed by the script itself.
Instruction hijack surface	0 (none)	There are no hidden instructions or attempts to override the agent; the text is procedural guidance about using the parser safely.
Irreversible actions	0 (none)	It only searches and extracts data; it does not publish, send, pay, book, deploy, or delete anything.
Transparency	2 (moderate)	Core parsing is delegated to an external `burpsuite-project-file-parser` JAR from GitHub, so the behavior that actually interprets project files is outside this repository.

Before installing

Inspect `scripts/burp-search.sh` to confirm it only launches local Burp/Java and does not modify files.
Review the external `burpsuite-project-file-parser` JAR/repo before trusting its output; it is not included here.
Test on a throwaway `.burp` project first and verify the exit-code behavior (especially 3 vs 4) before using sensitive traffic.
Only add the suggested `BURP_JAVA`/`BURP_JAR` exports to shell startup files if you really want them persisted.

Rated 2026-10-20 by an automated review of 4 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md
Branch: main
Collection: burpsuite-project-parser
Updated: 2026-09-19

cloudfront — Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions.
address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
audit-augmentation — Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.