zap-baseline
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides guidance for using the official OWASP ZAP toolset, a standard and trusted open-source project for web application security scanning.
- [SAFE]: All external resource references point to trusted ZAP Project locations, including official Docker images on the GitHub Container Registry (ghcr.io/zaproxy/zaproxy) and official GitHub Actions (zaproxy/action-baseline).
- [SAFE]: The documentation emphasizes secure secret management, specifically instructing users to avoid committing plaintext credentials to version control and instead use environment variables or CLI configuration overrides.
- [SAFE]: The skill provides a clear operational safety distinction between passive scanning (safe for production) and active scanning (reserved for staging), reducing the risk of accidental disruption to live services.
- [SAFE]: The package includes a set of evaluation scenarios containing intentional misconfigurations (such as hardcoded test credentials and flawed coverage logic) used as test cases for training; the skill's primary instructions correctly designate these as anti-patterns and provide secure alternatives.
Audit Metadata