How do I install the Owasp Zap skill?

Run npx skillmds@latest add codyswanngt/owasp-zap-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Owasp Zap safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Owasp Zap?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Owasp Zap free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Owasp Zap?

codyswanngt (@codyswanngt) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Owasp Zap by codyswanngt — Agent Skill

Name: Owasp Zap
Author: codyswanngt

Owasp Zap

This skill should be used when running or interpreting an OWASP ZAP baseline DAST scan of the Expo web export — after changes to HTTP headers, authentication, or security middleware, before deploying to staging or production, or when triaging ZAP findings from CI or pull request checks. Covers running scripts/zap-baseline.sh locally, risk-level triage, common findings and fixes, and .zap/baseline.conf rule configuration.

codyswanngt Updated Sep 21, 2026

File contents

OWASP ZAP Baseline Scanning

OWASP ZAP (Zed Attack Proxy) performs DAST (Dynamic Application Security Testing) by scanning a running application for common security vulnerabilities from the OWASP Top 10.

When to Use

After making changes to HTTP headers, authentication, or security middleware
Before deploying to staging or production
When reviewing security scan results from CI
When triaging ZAP findings from pull request checks

Running Locally

# Requires Docker to be installed and running
bash scripts/zap-baseline.sh

The scan builds the Expo web export, serves it locally, and runs ZAP against it. Reports are saved to zap-report.html, zap-report.json, and zap-report.md.

Interpreting Results

ZAP findings are categorized by risk level:

Risk	Action
High	Fix immediately — indicates exploitable vulnerability
Medium	Fix before deployment — security best practice violation
Low	Fix when convenient — minor security improvement
Informational	Review — may be false positive or acceptable risk

Common Findings and Fixes

Infrastructure-Level (fix at CDN/hosting, not in code)

CSP Header Not Set: Configure Content-Security-Policy at CDN or hosting platform. Expo web exports need script-src 'self' 'unsafe-inline' for hydration.
HSTS Not Set: Configure Strict-Transport-Security at CDN/load balancer.
X-Frame-Options: Use frame-ancestors in CSP at CDN level.

Application-Level (fix in code)

Cookie flags missing: Ensure all cookies set HttpOnly, Secure, and SameSite attributes.
Debug error messages: Ensure error boundaries don't leak stack traces in production.
Server version disclosure: Remove or mask the Server response header.

Configuration

ZAP scan rules are configured in .zap/baseline.conf. Each line controls how ZAP treats a specific rule:

IGNORE: Skip the rule entirely
WARN: Report finding but don't fail the build
FAIL: Fail the build if this finding is detected

CI Integration

ZAP runs automatically in CI via the zap-baseline.yml workflow. Results are uploaded as artifacts and the build fails on medium+ severity findings.

---name: owasp-zap-2description: This skill should be used when running or interpreting an OWASP ZAP baseline DAST scan of the Expo web export — after changes to HTTP headers, authentication, or security middleware, before deploying to staging or production, or when triaging ZAP findings from CI or pull request checks. Covers running scripts/zap-baseline.sh locally, risk-level triage, common findings and fixes, and .zap/baseline.conf rule configuration.---# OWASP ZAP Baseline ScanningOWASP ZAP (Zed Attack Proxy) performs DAST (Dynamic Application Security Testing) by scanning a running application for common security vulnerabilities from the OWASP Top 10.## When to Use- After making changes to HTTP headers, authentication, or security middleware- Before deploying to staging or production- When reviewing security scan results from CI- When triaging ZAP findings from pull request checks## Running Locally```bash# Requires Docker to be installed and runningbash scripts/zap-baseline.sh```The scan builds the Expo web export, serves it locally, and runs ZAP against it. Reports are saved to `zap-report.html`, `zap-report.json`, and `zap-report.md`.## Interpreting ResultsZAP findings are categorized by risk level:| Risk | Action ||------|--------|| **High** | Fix immediately — indicates exploitable vulnerability || **Medium** | Fix before deployment — security best practice violation || **Low** | Fix when convenient — minor security improvement || **Informational** | Review — may be false positive or acceptable risk |## Common Findings and Fixes### Infrastructure-Level (fix at CDN/hosting, not in code)- **CSP Header Not Set**: Configure Content-Security-Policy at CDN or hosting platform. Expo web exports need `script-src 'self' 'unsafe-inline'` for hydration.- **HSTS Not Set**: Configure Strict-Transport-Security at CDN/load balancer.- **X-Frame-Options**: Use `frame-ancestors` in CSP at CDN level.### Application-Level (fix in code)- **Cookie flags missing**: Ensure all cookies set `HttpOnly`, `Secure`, and `SameSite` attributes.- **Debug error messages**: Ensure error boundaries don't leak stack traces in production.- **Server version disclosure**: Remove or mask the `Server` response header.## ConfigurationZAP scan rules are configured in `.zap/baseline.conf`. Each line controls how ZAP treats a specific rule:- `IGNORE`: Skip the rule entirely- `WARN`: Report finding but don't fail the build- `FAIL`: Fail the build if this finding is detected## CI IntegrationZAP runs automatically in CI via the `zap-baseline.yml` workflow. Results are uploaded as artifacts and the build fails on medium+ severity findings.

Frequently asked questions