Skill

integrating-dast-with-owasp-zap-in-pipeline

skill:mukul975/anthropic-cybersecurity-skills#integrating-dast-with-owasp-zap-in-pipeline

Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:16 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

143/143

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/integrating-dast-with-owasp-zap-in-pipeline:skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md:171:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill's example Docker Compose files instruct pulling the official OWASP ZAP scanner image by the mutable :latest tag, so the scanner code executed in the documented pipeline is not pinned to a version.

skills/integrating-dast-with-owasp-zap-in-pipeline/SKILL.md:171

image: zaproxy/zap-stable:latest

vector:instructionvector:mixed

Counter-argument considered

The claim is verbatim accurate: both compose examples pull the official ZAP image by the mutable :latest tag and the bundled scripts run the untagged (defaulting-to-latest) equivalent, and the artifact contains no pinning guidance or mitigation. An unpinned official-registry pull is not the pinned-install carve-out, so this low-severity supply-chain finding survives all four gates.

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

invalid_judge_finding behavior-chains.0