Skill

intercepting-mobile-traffic-with-burpsuite

skill:mukul975/anthropic-cybersecurity-skills#intercepting-mobile-traffic-with-burpsuite

Intercepts and analyzes HTTP/HTTPS traffic from mobile applications using Burp Suite proxy to identify insecure API communications, authentication flaws, data leakage, and server-side vulnerabilities. Use when performing mobile application penetration testing, assessing API security, or evaluating client-server communication patterns. Activates for requests involving mobile traffic interception, Burp Suite mobile proxy, API security testing, or mobile HTTPS analysis.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:00 UTC at 54a7988

findings

high

highest severity

threat classes

4,532

files scanned

133/134

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/intercepting-mobile-traffic-with-burpsuite:skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md:171:EXEC

Security findings 1

Code execution

highContextual riskmedium confidence

The skill instructs launching Frida against the target application while loading ssl-pinning-bypass.js, an executable Frida script referenced by the documentation but not shipped or shown in the reviewed content, so the code actually executed is unverifiable.

skills/intercepting-mobile-traffic-with-burpsuite/SKILL.md:171

frida -U -f com.target.app -l ssl-pinning-bypass.js

vector:instruction

Counter-argument considered

The quote accurately shows the skill instructing 'frida -U -f com.target.app -l ssl-pinning-bypass.js', and the referenced script is neither shipped nor documented in any shown unit, so neither the documented-attack-payload nor the declared-core-capability carve-out covers executing unverifiable runtime code (a missing file never makes such an instruction harmless or chain-free). The instruction itself is overt inside the declared pinning-handling step, so no concealment claim fails, no mitigation exists, and the finding stands as a contextual risk.

Open questions 2

What the analysis could not settle from the code alone.

[file request skills/intercepting-mobile-traffic-with-burpsuite/scripts/ssl-pinning-bypass.js] SKILL.md Step 7 instructs the agent to run `frida -U -f com.target.app -l ssl-pinning-bypass.js`; does this artifact ship that script, and if so does it perform any behavior beyond SSL pinning bypass on the target test device (network sends, file writes, shell execution, persistence)?

Code execution

[file request skills/intercepting-mobile-traffic-with-burpsuite/ssl-pinning-bypass.js] Does this skill ship ssl-pinning-bypass.js, and if so what does the Frida script do: hook only SSL/TLS APIs for pinning bypass, or also read files or credentials, execute commands, or send captured traffic off-host?

Code execution

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:4b9297b896872dc9

invalid_judge_finding behavior-chains.0