Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →aiskillstore/dast-zap
Dynamic application security testing (DAST) using OWASP ZAP (Zed Attack Proxy) with passive and active scanning, API testing, and OWASP Top 10 vulnerability detection.
Passed 15 of 22 test cases with the skill, and 9 of 22 without it.
and 5 more in the full report
7 fixed8 passed either way6 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
When running a ZAP baseline scan against https://web.example.com inside Docker, the remote WAF keeps rate-limiting our scanner. Provide the Docker command to throttle the scan down to 1 thread per host and add a 1000ms delay between requests.
| Checked | Without skill | With skill |
|---|---|---|
| The command passes -z containing -config scanner.threadPerHost=1 | Missed | Passed |
| The command passes -z containing -config scanner.delayInMs=1000 | Missed | Passed |
The instructions your model reads when the skill loads.
OWASP ZAP (Zed Attack Proxy) is an open-source DAST tool that acts as a manipulator-in-the-middle proxy to intercept, inspect, and test web application traffic for security vulnerabilities. ZAP provides automated passive and active scanning, API testing capabilities, and seamless CI/CD integration for runtime security testing.
Run a quick passive security scan:
docker run -t zaproxy/zap-stable zap-baseline.py -t https://target-app.com -r baseline-report.html
Perform comprehensive active vulnerability testing:
docker run -t zaproxy/zap-stable zap-full-scan.py -t https://target-app.com -r full-scan-report.html
Test APIs using OpenAPI/Swagger specification:
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap-api-scan.py \
-t https://api.target.com \
-f openapi \
-d /zap/wrk/openapi-spec.yaml \
-r /zap/wrk/api-report.html
test cases passed, vs 9 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.