owasp-zap

Official, purpose-aligned OWASP ZAP skill with no clear malware indicators or covert exfiltration. Security risk is still high because it equips an AI agent with penetration-testing capability and active scanning that can impact real systems if used on the wrong target; supply-chain risk is moderate-low and mainly due to mutable image/action references and a stale Java version requirement.