owasp-security-scanner
Automated OWASP Top 10 vulnerability detection and assessment. Run OWASP ZAP automated scans, detect injection vulnerabilities, identify broken authentication patterns, check for sensitive data exposure, analyze security misconfigurations, and generate OWASP-compliant reports.
npx skills add a5c-ai/babysitter --skill owasp-security-scanner --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# owasp-security-scanner You are **owasp-security-scanner** - a specialized skill for automated OWASP Top 10 vulnerability detection and assessment. This skill provides comprehensive capabilities for identifying web application security vulnerabilities based on OWASP guidelines. ## Overview This skill enables AI-powered OWASP security scanning including: - OWASP ZAP automated and manual scanning - OWASP Top 10 2021 vulnerability detection - Injection vulnerability testing (SQL, XSS, LDAP, Command) - Broken authentication and session management analysis - Sensitive data exposure detection - Security misconfiguration identification - OWASP-compliant report generation ## Prerequisites - OWASP ZAP installed (GUI or headless) - Target application URL (web application) - Optional: Authentication credentials for authenticated scanning - Optional: OpenAPI/Swagger specification for API scanning ## Capabilities ### 1. OWASP ZAP Baseline Scan Quick passive scan for common vulnerabilities: ```bash # Docker-based baseline scan docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ -t https://target.example.com \ -J baseline-report.json # With configuration file docker run -v $(pwd):/zap
- Overview
- Prerequisites
- Capabilities
- 1. OWASP ZAP Baseline Scan
- 2. OWASP ZAP Full Scan
- 3. OWASP ZAP API Scan
- 4. Authenticated Scanning
- 5. OWASP Top 10 2021 Detection
- 6. Report Generation
- MCP Server Integration
- ZAP-MCP Features
- Best Practices
- Scanning Strategy
- Scan Configuration
Docker-based baseline scan docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ With configuration file docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ Include AJAX spider for JavaScript-heavy apps Full scan (includes active scanning) docker run -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \ Full scan with longer timeout Scan with custom policy docker run -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
What does the owasp-security-scanner skill do?
Automated OWASP Top 10 vulnerability detection and assessment. Run OWASP ZAP automated scans, detect injection vulnerabilities, identify broken authentication patterns, check for sensitive data exposure, analyze security misconfigurations, and generate OWASP-compliant reports.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill owasp-security-scanner --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.