The Agent Skills Directory

[COMMAND_EXECUTION]: The Python scripts scripts/agent.py and scripts/process.py utilize the subprocess module to execute docker commands. This is the intended design for orchestrating OWASP ZAP scans from within a CI/CD environment. The use of list-based arguments instead of shell strings prevents command injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The file references/workflows.md contains example authentication credentials (testuser and testpass123) within a markdown block. These are clearly documented as illustrative placeholders for configuring authenticated scans and do not represent hardcoded secrets.
[EXTERNAL_DOWNLOADS]: The skill's scripts and configuration files pull and execute the zaproxy/zap-stable Docker image. This is the official distribution for the OWASP ZAP project, a well-known and trusted tool in the cybersecurity industry.

integrating-dast-with-owasp-zap-in-pipeline