The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and CI/CD templates utilize official Docker images (zaproxy/zap-stable) and GitHub Actions (e.g., zaproxy/action-baseline) from the OWASP ZAP organization, which is a well-known and reputable entity in the security community.
[COMMAND_EXECUTION]: The documentation provides commands for executing security scans via docker and python3. The provided GitHub Action template (assets/github_action.yml) includes sudo apt-get install -y jq, which is a standard procedure for installing dependencies within CI/CD runner environments.
[CREDENTIALS_UNSAFE]: Several reference files and templates, such as references/authentication_guide.md and assets/zap_context.xml, contain placeholder passwords (e.g., 'SecureP@ssw0rd', 'TestPassword123!'). These are clearly marked as examples, and the skill explicitly instructs users to manage actual credentials using environment variables.
[NO_CODE]: Several automated scripts referenced in the core workflow, such as scripts/zap_auth_scanner.py and scripts/ci_integration.sh, are missing from the provided file set. While this limits the skill's out-of-the-box automation, it does not introduce a security vulnerability in the existing files.

dast-zap