Burp Suite scanning via MCP tools — passive traffic analysis, active payload testing, OOB verification, and vulnerability reporting using Burp's proxy, HTTP sender, Collaborator, and scanner APIs. Use when the user has Burp Suite running with the AI Agent MCP server and wants to scan, test, or analyze web traffic…
A workflow for examining JavaScript in a real browser to find where login data, API requests, form fields, or responses are encrypted or signed. It then produces code and connection documentation for using that logic elsewhere.
Operate BurpSuite MCP Bridge for professional, authorized web testing. Use when Codex needs to inspect Burp live/history/logger/selection traffic, prioritize one target, retrieve a decisive request/response, intercept and edit a request or response before forwarding, replay one controlled mutation, manage temporary…
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging…
Operate an already configured burp-mcp server for authorized web application security testing, penetration testing, vulnerability assessment, and Burp Suite automation: inspect Proxy HTTP/WebSocket history, scope, and site map; craft and replay requests in Repeater; run bounded parallel fuzzing, race condition jobs…
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
A command-line workflow for analysing Android APK files, which are installable Android application packages. It covers reading app code and configuration, changing low-level code, rebuilding the package, and observing the app while it runs.
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's…