The Agent Skills Directory

[NO_CODE]: The skill consists exclusively of instructional documentation and workflow guidelines. It does not include any scripts, executables, or automated command-line instructions.
[EXTERNAL_DOWNLOADS]: The documentation references official security tools and repositories, including OWASP ZAP and the zaproxy/action-baseline GitHub Action. These are well-known, reputable resources within the security industry and are documented neutrally for workflow integration.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting external data (DAST scan reports). However, it explicitly recommends keeping raw reports as attachments rather than inlining them into the prompt context and emphasizes manual verification of findings, which effectively mitigates risks associated with untrusted tool output.

dast-workflow