mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
Jonathan Hefner
debfb29c8e
* Fix `allowed-tools` to use spec-compliant space-delimited strings Per the agentskills.io specification, `allowed-tools` must be a single string of space-delimited patterns, not a YAML list. Converted all 23 SKILL.md files from the `- Item` list format to the correct `"Item1 Item2"` string format. Also updated the frontmatter examples in CLAUDE.md and the workflow-skill-design skill template to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix remaining allowed-tools format in firebase-apk-scanner and workflow-skill-design docs - Convert firebase-apk-scanner from comma-separated to space-delimited - Update anti-patterns.md and tool-assignment-guide.md examples from YAML lists to space-delimited strings - Remove unnecessary quotes from SKILL.md template placeholder Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Cover commands, new SKILL.md files, and fix template placeholder Extends the previous spec-compliance fixes: * Convert command frontmatter (commands/*.md) — per Claude Code docs, command files use the same frontmatter as skills, so the same space-delimited rule applies. * Convert three SKILL.md files added since the original PR: mutation-testing, trailmark-structural, trailmark-summary. * Fix the placeholder in the workflow-skill-design template. The previous "[minimum tools needed, space-delimited]" was YAML flow-sequence syntax, which parses as a list — the opposite of what the placeholder claims. Replaced with a concrete-looking space-delimited example plus a comment. Zeroize-audit agent files still use `allowed-tools:` in YAML list form. They are intentionally excluded: per the project's own docs (workflow-skill-design references), agents declare tools with `tools:` (not `allowed-tools:`). Fixing those requires changing the field name as well as the format and is out of scope for this PR. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * zeroize-audit agents: switch allowed-tools to tools Subagents declare their tool allowlist via `tools:` (comma-separated), not `allowed-tools:` — see Claude Code's subagent docs and this repo's own designing-workflow-skills/SKILL.md:47: > Skills use `allowed-tools:` in frontmatter. Agents use `tools:` > in frontmatter. Before this change, the zeroize-audit agents declared their tool list under `allowed-tools:`, which Claude Code does not read for subagents. The field was effectively a no-op; the spawned agents had no tool restriction enforced. Renames the field on all 11 agents to `tools:` and reformats the YAML list as comma-separated to match the documented format and existing agents elsewhere in the repo (e.g. function-analyzer.md, spec-compliance-checker.md). Tool sets are unchanged. Behavior change: tools now actually constrain what each spawned agent can call. The lists are the ones the original author intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * skill-improver: convert command allowed-tools to space-delimited The two command files in plugins/skill-improver/commands/ still used the JSON flow-array format (`allowed-tools: ["..."]`), which the rest of this PR converted everywhere else. Convert them to the spec-compliant space-delimited string form for consistency. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Dan Guido <dan@trailofbits.com>
Burp Suite Project Parser
Search and extract data from Burp Suite project files (.burp) for use in Claude
Author: Will Vandevanter
Prerequisites
- Burp Suite Professional - Required for project file support
- burpsuite-project-file-parser extension - Must be installed in Burp Suite (Available: https://github.com/BuffaloWill/burpsuite-project-file-parser)
- jq (optional) - Recommended for formatting/filtering JSON output
When to Use
Use this skill when you need to get the following from a Burp project:
- Search response headers or bodies using regex patterns
- Extract security audit findings and vulnerabilities
- Dump proxy history or site map data for analysis
- Programmatically analyze HTTP traffic captured by Burp Suite
Trigger phrases: "search the burp project", "find in burp file", "what vulnerabilities in the burp", "get audit items from burp"
What It Does
This skill provides CLI access to Burp Suite project files through the burpsuite-project-file-parser extension:
- Search headers/bodies - Find specific patterns in captured HTTP traffic using regex
- Extract audit items - Get all security findings with severity, confidence, and URLs
- Dump traffic data - Export proxy history and site map entries as JSON
- Filter output - Use sub-component filters to optimize performance on large projects
Installation
/plugin install trailofbits/skills/plugins/burpsuite-project-parser
Usage
Base command:
scripts/burp-search.sh /path/to/project.burp [FLAGS]
Available Commands
| Command | Description | Output |
|---|---|---|
auditItems |
Extract all security findings | JSON: name, severity, confidence, host, port, protocol, url |
proxyHistory |
Dump all captured HTTP traffic | Complete request/response data |
siteMap |
Dump all site map entries | Site structure |
responseHeader='.*regex.*' |
Search response headers | JSON: url, header |
responseBody='.*regex.*' |
Search response bodies | Matching content |
Sub-Component Filters
For large projects, filter to specific data to improve performance:
proxyHistory.request.headers # Only request headers
proxyHistory.request.body # Only request body
proxyHistory.response.headers # Only response headers
proxyHistory.response.body # Only response body
Same patterns work with siteMap.*
Examples
Search for CORS headers:
scripts/burp-search.sh project.burp "responseHeader='.*Access-Control.*'"
Get all high-severity findings:
scripts/burp-search.sh project.burp auditItems | jq 'select(.severity == "High")'
Find server signatures:
scripts/burp-search.sh project.burp "responseHeader='.*(nginx|Apache|Servlet).*'"
Extract request URLs from proxy history:
scripts/burp-search.sh project.burp proxyHistory.request.headers | jq -r '.request.url'
Search for HTML forms:
scripts/burp-search.sh project.burp "responseBody='.*<form.*action.*'"
Output Format
All output is JSON, one object per line. Pipe to jq for formatting or use grep for filtering:
scripts/burp-search.sh project.burp auditItems | jq .
scripts/burp-search.sh project.burp auditItems | grep -i "sql injection"