The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for the agent to execute docker run commands to perform security scanning. These commands include volume mounts (-v $(pwd):/zap/wrk) to facilitate the generation and storage of JSON scan reports in the local working directory.
[EXTERNAL_DOWNLOADS]: The instructions reference the official zaproxy/zap-stable Docker image and the zaproxy.org website for tool installation. These are well-known resources provided by the OWASP foundation.
[PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it instructs the agent to read and summarize JSON findings generated from scanning external web applications. Content from the target application could potentially influence the agent's summary.
Ingestion points: Scan result files zap-baseline-results.json, zap-full-results.json, and zap-api-results.json (SKILL.md).
Boundary markers: None present in the instructions.
Capability inventory: Shell command execution via docker (SKILL.md).
Sanitization: No explicit sanitization of the JSON output content is specified before the agent processes it.

dast-zap