burp-suite-testing

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.

Quality

61%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/burp-suite-testing/SKILL.md

Quality

Content

63%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is well-structured, actionable, and safely gated for an offensive skill, but it is overly long for a single file, re-explains GUI basics Claude could assume, and makes no use of progressive disclosure through reference files.

Suggestions

Move the Common Testing Payloads, Troubleshooting, and Editions Comparison into separate reference files (e.g., references/payloads.md, references/troubleshooting.md) and link to them from SKILL.md to apply progressive disclosure.

Trim GUI-navigation boilerplate (e.g., 'Click Open Browser', 'Go to Proxy > Intercept tab') that Burp users already know, and remove the verbatim repetition of the description in the Purpose section.

Add an explicit validate-and-retry loop after automated scans (review issues -> confirm false positives -> re-test) to lift workflow clarity toward 5.

Dimension	Reasoning	Score
Conciseness	The body is mostly task-focused with tables and code blocks, but explains basic GUI navigation Burp users already know (e.g., 'Click Open Browser', 'Right-click target host') and repeats the description verbatim in the Purpose section, adding avoidable padding.	3 / 5
Actionability	Provides concrete HTTP examples, payload lists, attack-type tables, and keyboard shortcuts that are directly usable, with only minor gaps (e.g., some 'code' blocks are UI click-paths rather than executable commands).	4 / 5
Workflow Clarity	Six clearly sequenced phases with step lists cover the full testing lifecycle, and the mandatory confirmation gate plus 'rate-limit scans' guardrail supply validation checkpoints; missing only an explicit validate-after-scan retry loop, so it does not quite reach 5.	4 / 5
Progressive Disclosure	The skill is a single ~400-line monolithic SKILL.md with no bundle files (references/scripts/assets absent); it is well section-headed but content that could live in separate files (payload library, troubleshooting, editions comparison) is all inlined, with no one-level-deep references.	3 / 5
	Total	14 / 20 Passed

Description

58%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is comprehensive in naming capabilities and targets a distinct Burp Suite niche, but it omits an explicit 'Use when...' trigger clause and leans on a few generic phrases, which limits trigger-term quality and completeness.

Suggestions

Add an explicit trigger clause such as 'Use when performing web application security testing, pentesting, or analyzing HTTP traffic with Burp Suite.'

Incorporate natural user phrasings and synonyms (e.g., 'pentest', 'web app testing', 'security assessment') alongside 'Burp Suite' to improve trigger-term coverage.

Tighten the capability list to name a few concrete Burp features (Repeater, Intruder, Scanner, Proxy) rather than only broad categories.

Dimension	Reasoning	Score
Specificity	Lists several concrete Burp actions (interception/modification, request analysis and replay, automated scanning, manual testing workflows), but clusters them into broad categories rather than naming individual sub-features, leaving minor coverage gaps.	4 / 5
Completeness	Clearly answers 'what' the skill does with a comprehensive capability list, but provides no 'Use when...' clause or explicit trigger guidance, which caps completeness at 3 per the rubric.	3 / 5
Trigger Term Quality	Contains relevant keywords ('HTTP traffic', 'vulnerability scanning', 'web application security testing') but lacks common natural variations users would say (e.g., 'pentest', 'web app testing', 'security assessment', 'Burp') as standalone triggers.	3 / 5
Distinctiveness Conflict Risk	The Burp Suite niche is fairly distinct with specific proxy-based testing methodology, with only minor overlap risk against other web-security or pentesting skills.	4 / 5
	Total	14 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: sickn33/antigravity-awesome-skills
Path: skills/burp-suite-testing/SKILL.md
Commit: 1f67c44

Reviewed: about 15 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.