Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "dast-zap" from https://skillstore.io/skills/agentsecops-dast-zap.md and its manifest at https://skillstore.io/api/skills/agentsecops-dast-zap/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "dast-zap". Plan a ZAP scan for a staging application before release.
Expected outcome:
Using "dast-zap". Set up authenticated scanning for a form login.
Expected outcome:
Using "dast-zap". Triage ZAP findings after a scan.
Expected outcome:
Most static detections are documentation or visible templates for authorized OWASP ZAP testing and were dismissed as false positives. Confirmed issues include privileged package installation and an API-key-in-URL example. Semantic review also found reusable fixed credentials, fail-open GitLab gates, and mutable CI dependencies; no prompt injection or malicious intent was found.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-dast-zap/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-dast-zap?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-dast-zap?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-dast-zap/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-dast-zap.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). dast-zap security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-dast-zap/audits/9@techreport{agentsecops-agentsecops-dast-zap-2026,
author = {AgentSecOps},
title = {dast-zap security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-dast-zap/audits/9},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dast-zap security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-dast-zap/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-dast-zap:audit:9"
description: "Skillstore immutable audit report identifier"
Create a CI job that runs ZAP against staging and publishes reports for release review.
Configure ZAP authentication context files and test protected pages with dedicated test accounts.
Use OpenAPI, GraphQL, or SOAP guidance to scan API endpoints and review findings.
Help me plan an authorized OWASP ZAP baseline scan for my staging URL. Include scope, report outputs, and safe defaults.
Draft CI steps for an OWASP ZAP scan against staging. Include artifacts, thresholds, and how to handle scan failures.
Guide me through an authenticated ZAP scan using test credentials from environment variables and a verification URL.
Design an OWASP ZAP API testing workflow for OpenAPI and GraphQL endpoints. Include authentication, rate limits, and reporting.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r1
Ref
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
10 downloads · 219 views
File structure
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Scan Python Code with Bandit
Python security flaws can reach production unnoticed. This skill guides Bandit scans, prioritization, CI integration, and remediation with CWE and OWASP references.
Review Web App Security Before Release
by sickn33
Security issues often appear when teams add authentication, APIs, payments, uploads, or sensitive data flows. This skill provides a focused checklist and review prompts for finding common web application risks before deployment.
Audit Python Web Apps Before Release
by glenskii
Python teams need repeatable checks for common application security controls. This skill provides configurable pytest coverage with clear evidence, boundaries, and release decisions.
Run OWASP Web Security Testing
by sickn33
Web teams need a repeatable way to check common application risks before release. This skill organizes OWASP testing into phases, prompts, and reporting steps.
Validate Inputs Across Entry Points
by EIS-ITS
Input validation often becomes inconsistent across forms, APIs, and business rules. This skill guides Claude, Codex, and Claude Code toward secure validation patterns.
Protect Next.js Auth Routes
by AayushBaniya2006
Authentication changes often fail when teams mix session APIs and route guards. This skill guides Claude, Codex, and Claude Code toward the project helpers for secure access control.
Build Reliable Test Automation
by 89jobrien
Weak tests slow releases and hide regressions. This skill guides test strategy, TDD, automation, coverage review, and Playwright web checks.