SECURITY / trailofbits
Burp Project Parser
Extract and search captured Burp traffic while distinguishing empty results from parser startup failures.
“Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit”
01 / THE REASONING
Why this made the selection.
- Parsing is delegated to a local Burp Suite Professional process. The skill text says it does not parse .burp files itself.
- Response bodies longer than 1000 characters are forbidden in the agent context, and full proxy or site-map dumps are marked to avoid.
- The wrapper checks required files, classifies empty and non-object output separately, preserves Java failures and bounds non-JSON stderr.
- Inspect captured request headers before selecting bounded response bodies
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md
- plugins/burpsuite-project-parser/skills/burpsuite-project-parser/scripts/burp-search.sh
- LICENSE
- README.md
Our findings
- The skill does not parse the project file. burp-search.sh runs the local Burp jar with java.awt.headless and a --project-file argument.
- It requires Burp Suite Professional and the project-file parser extension. Without the jar path it exits with an error.
- Bodies over 1000 characters must not be pulled into context, and the file says not to dump proxy history or the site map whole.
- The wrapper checks required files, classifies empty and non-object output separately, preserves Java failures and bounds non-JSON stderr.
- Source inspection confirms stdout filtering is lexical, not a JSON parser; SIGPIPE from intentional downstream truncation is handled.
Not established by this review
- The resource was not executed and its tools were not called.
- burp-search.sh was not executed and Burp was not started.
- No skill execution, authenticated service operation, or outcome benchmark was performed.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add trailofbits/skills/plugins/burpsuite-project-parser/skills/burpsuite-project-parserRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
Optional: install the reviewed revision
Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose.
npx skills add https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser- Install the pinned skill directory interactively, retaining its bundled references and scripts.
- Set BURP_JAVA and BURP_JAR when defaults do not match the installation.
- Run a small control query on the same project, preserve stderr and pipeline exit status, then narrow selectors and output size.
Before you start
- Burp Suite Professional
- burpsuite-project-file-parser extension
- Java, bash and bounded JSON-processing tools
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Pinned skill definition ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md
Supports: summary, whySelected, bestFor, limitations, install, access, review
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: install
- CC-BY-SA-4.0 licence ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: license
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/scripts/burp-search.sh
Supports: review, limitations, access, install