Agent skill · security · aiskillstore
dast-zap
Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection. Use when: (1) Performing runtime security testing of web applications and APIs, (2) Detecting vulnerabilities like XSS, SQL injection, and authentication flaws in deployed applications, (3) Automating security scans in CI/CD pipelines with Docker containers, (4) Conducting authenticated testing with session management, (5) Generating security reports with OWASP and CWE mappings for compliance.
Why this skill is useful
Adds specific commands for running DAST scans with OWASP ZAP that the AI wouldn't reliably generate on its own.
What it needs
Requires docker installed locally. About 7k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
DAST with OWASP ZAP Overview OWASP ZAP (Zed Attack Proxy) is an open-source DAST tool that acts as a manipulator-in-the-middle proxy to intercept, inspect, and test web application traffic for security vulnerabilities. ZAP provides automated passive and active scanning, API testing capabilities, and seamless CI/CD integration for runtime security testing. Quick Start Baseline Scan (Docker) Run a quick passive security scan: Full Active Scan (Docker) Perform comprehensive active vulnerability testing: API Scan with OpenAPI Spec Test APIs using OpenAPI/Swagger specification: Core Workflow Step 1: Define Scan Scope and Target Identify the target application URL and define scope: Scope Considerations: Exclude third-party domains and CDN URLs Include all application subdomains and API endpoints Respect scope limitations in penetration testing engagements Step 2: Run Passive Scanning Execute passive scanning to analyze traffic without active attacks: What Passive Scanning Detects: Missing security headers (CSP, HSTS, X-Frame-Options) Information disclosure in responses Cookie security issues (HttpOnly, Secure flags) Basic authentication weaknesses Application fingerprinting data Step 3: Execute Active Scanning Perform active vulnerability testing (requires authorization): Active Scanning Coverage: SQL Injection (SQLi) Cross-Site Scripting (XSS) Path Traversal Command Injection XML External Entity (XXE) Server-Side Request Forgery (SSRF) Security Misconfigurations WARNING: Active scanning performs real attacks. Only run against applications you have explicit authorization to test. Step 4: Test APIs with Specifications Scan REST, GraphQL, and SOAP APIs: Consult references/apitestingguide.md for advanced API testing patterns including authentication and rate limiting. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/dast-zap