The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts scripts/agent.py and scripts/process.py execute the OWASP ZAP security scanner using subprocess.run. These calls use list-based arguments to interact with the Docker CLI, which is a standard and secure method for executing external processes that avoids shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill references the official OWASP ZAP Docker image (zaproxy/zap-stable) and various GitHub Actions provided by the zaproxy organization. These are well-known and reputable resources within the cybersecurity community.
[SAFE]: No malicious patterns such as obfuscation, credential exfiltration, or unauthorized persistence mechanisms were detected. The skill implements recognized DevSecOps practices, and the example credentials provided in the documentation are clearly identified as non-sensitive placeholders.

integrating-dast-with-owasp-zap-in-pipeline