zap-dast-configurator SKILL.md skillA
zap-dast-configurator from pramoddutta/aitesterblueprint4x is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add pramoddutta/aitesterblueprint4x/zap-dast-configurator@v1.0.0Pins v1.0.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- pramoddutta/aitesterblueprint4x
- Path
chapter_14_MCP_Create_VIBE/testskill-finder-mcp/skills/framework-packs/security-pack/zap-dast-configurator/SKILL.md- Versions recorded
- 1
- Latest version
- v1.0.0, committed Oct 10, 2026
- Size
- 3,953 bytes
- Repository stars
- 14
- License
- none declared
Configures OWASP ZAP baseline and full scans in CI with the ZAP Docker image, a rules file to tune alerts, and report artifacts, then triages the findings. Use when a QA or DevSecOps engineer says "add a ZAP scan to our pipeline", "set up DAST in CI", "tune these ZAP alerts", or pastes a ZAP report. Produces a CI job, a rules file, and a triage table for authorized scans of your own app, a draft the engineer runs and verifies.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# ZAP DAST Configurator You wire **a ZAP scan into CI that the team trusts**: tuned rules, clear pass/fail, reports kept as artifacts, and every alert triaged instead of ignored. ## When to use - A web app or API needs automated DAST on each pull request or nightly build. - An existing ZAP job is noisy, always red, or always ignored. - Someone pastes a ZAP HTML/JSON report and asks which alerts are real. ## Workflow 1. **Confirm target and authorization.** A staging URL the team owns, written approval, and a scan window. Choose the scan: `zap-baseline.py` (spider plus passive rules, safe for shared envs), `zap-full-scan.py` (active attacks, dedicated test env only, never production), or `zap-api-scan.py -f openapi` for an API with a spec. 2. **Generate the rules file.** Run the baseline once with `-g rules.tsv` to list every rule, then set each line (tab-separated: rule id, action, name) to `IGNORE`, `INFO`, `WARN`, or `FAIL`, e.g. `10010 FAIL (Cookie No HttpOnly Flag)`. Pass it back with `-c rules.tsv`. 3. **Wire the CI job.** Mount a writable folder at `/zap/wrk`, write `-r` HTML, `-J` JSON and …
Read the whole file at its exact version.
How to install
mdr add pramoddutta/aitesterblueprint4x/zap-dast-configurator@sha256:b396d33644e5c387The line at the top of this page pins the label v1.0.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_exbim5yg72zdihlv)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Oct 10, 2026.
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (3953 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
pramoddutta/aitesterblueprint4x · 14 stars · license none declared · pushed 2026-10-11 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_exbim5yg72zdihlv GET https://markdownregistry.com/api/v1/resolve?ref=pramoddutta/aitesterblueprint4x/zap-dast-configurator GET https://markdownregistry.com/api/v1/blob/b396d33644e5c3877f43248cd28bda737961c83994f0f7c3a516adfb34fed63c
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.