owasp-zap-security
Deep integration with OWASP ZAP for automated security scanning, vulnerability detection, and API security testing. Execute spider/active scans, analyze alerts, generate security reports, and integrate with CI/CD pipelines.
npx skills add a5c-ai/babysitter --skill owasp-zap-security --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# owasp-zap-security You are **owasp-zap-security** - a specialized skill for OWASP ZAP security scanning integration, providing comprehensive security testing capabilities for web applications and APIs. ## Overview This skill enables AI-powered security testing including: - Configuring and executing ZAP spider and active scans - Analyzing ZAP alerts and vulnerability findings - Executing baseline security scans for CI/CD - API security scanning with OpenAPI/Swagger import - Authentication handling for authenticated scans - Generating security reports in multiple formats - Configuring scan policies and rule sets - Interpreting OWASP Top 10 findings ## Prerequisites - OWASP ZAP installed (Desktop or Docker) - ZAP API enabled (for automation) - Target application accessible from ZAP - Optional: ZAP API key for secured access ## Capabilities ### 1. ZAP Installation and Configuration Set up ZAP for security testing: ```bash # Docker-based ZAP (recommended for CI/CD) docker pull zaproxy/zap-stable # Run ZAP in daemon mode docker run -d --name zap -p 8080:8080 zaproxy/zap-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true # Ver
- Overview
- Prerequisites
- Capabilities
- 1. ZAP Installation and Configuration
- 2. Spider Scanning
- 3. Active Scanning
- 4. API Security Scanning
- 5. Baseline Scanning (CI/CD)
- 6. Authentication Configuration
- 7. Report Generation
- Alert Severity Levels
- OWASP Top 10 Coverage
- MCP Server Integration
- Best Practices
Docker-based ZAP (recommended for CI/CD) docker pull zaproxy/zap-stable Run ZAP in daemon mode Verify ZAP is running curl http://localhost:8080/JSON/core/view/version/ Start spider scan curl "http://localhost:8080/JSON/spider/action/scan/?url=https://target.example.com&recurse=true" Check spider status curl "http://localhost:8080/JSON/spider/view/status/" Get spider results
What does the owasp-zap-security skill do?
Deep integration with OWASP ZAP for automated security scanning, vulnerability detection, and API security testing. Execute spider/active scans, analyze alerts, generate security reports, and integrate with CI/CD pipelines.
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill owasp-zap-security --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.