codyswanngt/security-zap-scan
plugins/lisa-agy/skills/security-zap-scan/SKILL.md
Run an OWASP ZAP baseline security scan locally using Docker. Checks for the ZAP baseline script, executes the scan, and summarizes findings by risk level with remediation recommendations.
$ install --global
skillsauthnpx skillsauth add codyswanngt/lisa security-zap-scanInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 12, 2026, 3:02 AM5.7s1 file scanned
SKILL.md
- name:
- security-zap-scan
- description:
- Run an OWASP ZAP baseline security scan locally using Docker. Checks for the ZAP baseline script, executes the scan, and summarizes findings by risk level with remediation recommendations.
- allowed-tools:
- ["Bash", "Read"]
OWASP ZAP Baseline Security Scan
Run a ZAP baseline security scan against the local application.
Workflow
-
Check prerequisites:
- Verify Docker is installed and running:
docker info - Check if
scripts/zap-baseline.shexists in the project
- Verify Docker is installed and running:
-
Execute scan:
- If the script exists, run:
bash scripts/zap-baseline.sh - If the script does not exist, inform the user that this project does not have a ZAP baseline scan configured
- If the script exists, run:
-
Analyze results:
- After the scan completes, read
zap-report.html(orzap-report.mdfor text) - Summarize findings:
- Total number of alerts by risk level (High, Medium, Low, Informational)
- List each Medium+ finding with its rule ID, name, and recommended fix
- Categorize findings as "infrastructure-level" (fix at CDN/proxy) vs "application-level" (fix in code)
- After the scan completes, read
-
Handle failures:
- If the scan failed, explain what failed and suggest concrete remediation steps
Execution
Run the scan now.
Related Skills
codyswanngt/plugins/src/harper-fabric/skills/harper-realtime
tools
VerifiedTrustedCommunity
--- name: harper-realtime description: This skill should be used when adding or troubleshooting Harper (HarperDB/Fabric) real-time behavior: MQTT topics, WebSocket resource subscriptions, resource publish/subscribe handlers, SSE-style streaming routes, and local subscriber verification. Pairs with harper-resources, harper-config-yaml, harper-schema-graphql, and harper-build-and-deploy. --- # Harper Realtime ## Overview Harper exposes live data through the same Resource model used for REST and
1SKILL.mdUpdated Jun 13, 2026
codyswanngt/plugins/lisa-harper-fabric/skills/harper-realtime
tools
VerifiedTrustedCommunity
--- name: harper-realtime description: This skill should be used when adding or troubleshooting Harper (HarperDB/Fabric) real-time behavior: MQTT topics, WebSocket resource subscriptions, resource publish/subscribe handlers, SSE-style streaming routes, and local subscriber verification. Pairs with harper-resources, harper-config-yaml, harper-schema-graphql, and harper-build-and-deploy. --- # Harper Realtime ## Overview Harper exposes live data through the same Resource model used for REST and
1SKILL.mdUpdated Jun 13, 2026
codyswanngt/plugins/lisa-harper-fabric-cursor/skills/harper-realtime
tools
VerifiedTrustedCommunity
--- name: harper-realtime description: This skill should be used when adding or troubleshooting Harper (HarperDB/Fabric) real-time behavior: MQTT topics, WebSocket resource subscriptions, resource publish/subscribe handlers, SSE-style streaming routes, and local subscriber verification. Pairs with harper-resources, harper-config-yaml, harper-schema-graphql, and harper-build-and-deploy. --- # Harper Realtime ## Overview Harper exposes live data through the same Resource model used for REST and
1SKILL.mdUpdated Jun 13, 2026
codyswanngt/plugins/lisa-harper-fabric-copilot/skills/harper-realtime
tools
VerifiedTrustedCommunity
--- name: harper-realtime description: This skill should be used when adding or troubleshooting Harper (HarperDB/Fabric) real-time behavior: MQTT topics, WebSocket resource subscriptions, resource publish/subscribe handlers, SSE-style streaming routes, and local subscriber verification. Pairs with harper-resources, harper-config-yaml, harper-schema-graphql, and harper-build-and-deploy. --- # Harper Realtime ## Overview Harper exposes live data through the same Resource model used for REST and
1SKILL.mdUpdated Jun 13, 2026