dast-zap

SUSPICIOUS/HIGH-RISK but not malicious. The skill is internally consistent and uses official ZAP distribution paths, so it is not a credential-harvesting or deceptive supply-chain lure. However, it equips an AI agent with genuine offensive security scanning capability and automated active attacks, making the overall security risk high even though malware likelihood is low.