How do I install the Owasp Zap skill?

Run npx skillmds@latest add timsonner/owasp-zap in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Owasp Zap safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Owasp Zap?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Owasp Zap free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Owasp Zap?

timsonner (@timsonner) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Owasp Zap by timsonner — Agent Skill

Name: Owasp Zap
Author: timsonner

Owasp Zap

Use for OWASP-focused web and API testing during authorized pentests. Trigger on proxy-based web review, automated or manual scan support, baseline OWASP Top 10 coverage, and validating application security controls with a lighter-weight interception workflow.

timsonner 9ed8fd6 2.4 KB Updated Sep 17, 2026

File contents

OWASP ZAP

Purpose

Use this skill for OWASP Top 10-oriented web and API testing when the engagement needs a proxy, baseline scanner, or repeatable web validation workflow.

Phase Fit

Primary: Vulnerability Analysis
Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

Use When

Need baseline web scanning aligned to common OWASP categories.
Need proxy-based request inspection or replay.
Need repeatable web retests after remediation.

Avoid When

Target workflows are highly stateful and require more manual control than the chosen scan mode provides.
Automated scanning would exceed the approved impact level.

Inputs

Approved web target or API base URL
Auth context, scan depth, and exclusions
Output and evidence requirements

Procedure

Start with passive or baseline analysis before active checks.
Scope scanning to the approved application areas.
Manually validate material findings before escalation.
Record the exact scan profile and exclusions used.
Preserve the scan path for retest.

Command Syntax

Replace sample targets with approved in-scope URLs.

# Passive baseline scan via Docker
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://portal.contoso.com -r contoso-zap-report.html

# Full active scan via Docker
docker run -t owasp/zap2docker-stable zap-full-scan.py -t https://portal.contoso.com -r contoso-full.html

# API scan against OpenAPI spec
docker run -t owasp/zap2docker-stable zap-api-scan.py -t https://api.contoso.com/openapi.json -f openapi -r contoso-api.html

# Start ZAP as daemon (local install)
zaproxy -daemon -host 127.0.0.1 -port 8080

# Quick URL scan from CLI
zaproxy -cmd -quickurl https://portal.contoso.com -quickout contoso-zap.html

Evidence to Capture

Confirmed web findings relevant to OWASP categories
Exact target, auth context, and scan profile used
Minimal reproduction path for retest

Safety Boundaries

Start passive and keep active checks within approved scope.
Treat scanner output as triage input until manually confirmed.

---name: owasp-zapdescription: Use for OWASP-focused web and API testing during authorized pentests. Trigger on proxy-based web review, automated or manual scan support, baseline OWASP Top 10 coverage, and validating application security controls with a lighter-weight interception workflow.license: MIT---# OWASP ZAP## PurposeUse this skill for OWASP Top 10-oriented web and API testing when the engagement needs a proxy, baseline scanner, or repeatable web validation workflow.## Phase Fit- Primary: Vulnerability Analysis- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure## Use When- Need baseline web scanning aligned to common OWASP categories.- Need proxy-based request inspection or replay.- Need repeatable web retests after remediation.## Avoid When- Target workflows are highly stateful and require more manual control than the chosen scan mode provides.- Automated scanning would exceed the approved impact level.## Inputs- Approved web target or API base URL- Auth context, scan depth, and exclusions- Output and evidence requirements## Procedure1. Start with passive or baseline analysis before active checks.2. Scope scanning to the approved application areas.3. Manually validate material findings before escalation.4. Record the exact scan profile and exclusions used.5. Preserve the scan path for retest.## Command SyntaxReplace sample targets with approved in-scope URLs.```bash# Passive baseline scan via Dockerdocker run -t owasp/zap2docker-stable zap-baseline.py -t https://portal.contoso.com -r contoso-zap-report.html# Full active scan via Dockerdocker run -t owasp/zap2docker-stable zap-full-scan.py -t https://portal.contoso.com -r contoso-full.html# API scan against OpenAPI specdocker run -t owasp/zap2docker-stable zap-api-scan.py -t https://api.contoso.com/openapi.json -f openapi -r contoso-api.html# Start ZAP as daemon (local install)zaproxy -daemon -host 127.0.0.1 -port 8080# Quick URL scan from CLIzaproxy -cmd -quickurl https://portal.contoso.com -quickout contoso-zap.html```## Evidence to Capture- Confirmed web findings relevant to OWASP categories- Exact target, auth context, and scan profile used- Minimal reproduction path for retest## Safety Boundaries- Start passive and keep active checks within approved scope.- Treat scanner output as triage input until manually confirmed.

Frequently asked questions