burp-suite-testing

This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.

Quality

72%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/burp-suite-testing/SKILL.md

Quality

Content

57%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, well-structured Burp Suite testing guide with concrete examples, weakened by generic payload content Claude already knows, missing validation checkpoints on batch/destructive operations, and a monolithic structure with no reference-file split.

Suggestions

Remove or externalize the "Common Testing Payloads" section — generic SQLi/XSS/path-traversal payloads are knowledge Claude already has and waste context.

Add explicit validation checkpoints to batch/destructive workflows (e.g. confirm scope before Intruder attacks, verify authorization and rate limits before launching scans) to lift workflow clarity above the cap of 3.

Split large reference material (payload libraries, troubleshooting, scan-configuration details) into files under references/ and link to them from SKILL.md to improve progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient with structured tables and UI navigation, but the "Common Testing Payloads" section reproduces generic SQLi/XSS/path-traversal/command-injection payloads Claude already knows, and several explanatory bullets could be trimmed; not verbose enough for a 2, but not lean enough for a 4.	3 / 5
Actionability	Concrete UI paths ("Proxy > Intercept", "Target > Site map"), copy-paste HTTP request examples, attack-type tables, and explicit payload-position configs give mostly executable guidance; minor gaps (e.g. scan configuration specifics) keep it just below a 5.	4 / 5
Workflow Clarity	Six phases are clearly sequenced, but batch/destructive operations (Intruder brute force, automated scans) lack explicit validation checkpoints and feedback loops woven into the workflow; per the rubric cap this cannot exceed 3, and it is not below 3 because the sequence itself is coherent.	3 / 5
Progressive Disclosure	The file is well-organized with clear section headers, but it is a monolithic ~380-line SKILL.md with no references to separate files and no bundle files; content such as detailed payload lists and troubleshooting could be split out, placing it at the midpoint rather than a 2 (structure exists) or 4 (no file split).	3 / 5
	Total	13 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-constructed description that clearly states both purpose and trigger conditions with concrete, natural phrases. Minor specificity gains are possible by trimming the generic closing clause.

Dimension	Reasoning	Score
Specificity	Lists several concrete actions ("intercept HTTP traffic", "modify web requests", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", "configure proxy for web testing") with only minor coverage gaps; the trailing "comprehensive guidance for using Burp Suite's core features" is mildly generic, keeping it just below a 5.	4 / 5
Completeness	Explicitly answers both what ("comprehensive guidance for using Burp Suite's core features for web application security testing") and when ("This skill should be used when the user asks to..." with concrete trigger phrases), matching the top anchor.	5 / 5
Trigger Term Quality	Seven quoted natural phrases users would actually say (e.g. "use Burp Suite for testing", "configure proxy for web testing") give good keyword coverage; a few common variations (e.g. fuzzing, brute-force login, injection testing) are missing, so not a 5.	4 / 5
Distinctiveness Conflict Risk	The tool-specific Burp Suite niche with distinct, named triggers (Repeater, proxy, HTTP history) makes conflict with other skills minimal.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: zebbern/claude-code-guide
Path: skills/burp-suite-testing/SKILL.md
Commit: 8428a63

Reviewed: about 2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.