skills.rest
IgorSasovets
IgorSasovetsCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

zap-review

Extracts and deduplicates OWASP ZAP findings, then verifies each against a live target via Burp Suite.

9|2|Updated Jul 15, 2026
Search Tags:#security testing#penetration testing#DevSecOps#DAST#Burp Suite#owasp zap#vulnerability verification
One-click install
npx skills add https://github.com/IgorSasovets/devsecops-with-claude --skill zap-review-igorsasovets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: zap-review
Source: https://github.com/IgorSasovets/devsecops-with-claude/tree/main/zap-report-reviewer/.claude/skills/ZAP_REVIEW
Command: npx skills add https://github.com/IgorSasovets/devsecops-with-claude --skill zap-review-igorsasovets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? OWASP ZAP scan reports contain false positives and duplicated alerts that require tedious manual verification against the live application. This Skill automates the extraction, deduplication, and live re-testing of every finding, producing an evidence-backed verification report with full HTTP request/response proof of concept. ## Core Features & Use Cases - Report Parsing and Deduplication: Parses ZAP reports in JSON, HTML, or PDF format, applies severity and exclusion filters, and groups duplicate findings by endpoint, method, and parameter. - Live Verification via Burp Suite MCP: Re-tests each grouped finding against the live target through the Burp Suite MCP server (with curl fallback), creating Repeater tabs for confirmed issues. - Evidence-Based Reporting: Produces ISSUES_LIST.md and ISSUES_LIST_VERIFIED.md containing reproduction steps and real HTTP request/response PoCs classified as CONFIRMED, NOT_CONFIRMED, INCONCLUSIVE, or SKIPPED. - Use Case: After a CI pipeline runs a ZAP baseline scan against a staging API, run this Skill to automatically triage 200 raw alerts into 30 verified groups, confirming which SQL injection and XSS findings are real before assigning them to developers. ## Quick Start Ask the AI to review the ZAP report at ./zap-report.json against https://staging.example.com and verify each finding live.

Frequently Asked Questions about zap-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify OWASP ZAP scan findings automatically?▼

Provide the ZAP report path and target base URL, and the Skill parses the report, deduplicates alerts into groups, then re-tests each group against the live target via Burp Suite MCP. Results are written to ISSUES_LIST_VERIFIED.md with full HTTP PoCs.

What ZAP report formats are supported for parsing?▼

JSON, HTML, and PDF reports are supported. JSON is preferred and parsed from the site/alerts structure; HTML is parsed from alert summary tables; PDF is converted with pdftotext or pdfminer before parsing.

Does ZAP report verification work without Burp Suite?▼

Yes, a curl fallback mode is available when the Burp MCP server is unreachable. Requests made via curl will not appear in Burp history and no Repeater tabs are created, which the report notes explicitly.

How are duplicate ZAP alerts handled during triage?▼

Alerts sharing the same vulnerability class, HTTP method, endpoint path template, and parameter are grouped together. Only one representative instance per group is verified over the network, and the result applies to all grouped instances.

Can I run ZAP finding verification in a CI/CD pipeline?▼

Yes, CI mode is detected via the CI environment variable and reads all inputs from zap-review-config.yml, which must set authorized: true. Missing required fields or failed prerequisites halt with named error codes and no partial output.

What safety limits apply to live vulnerability verification?▼

Verification requires explicit authorization, never performs destructive actions, and only uses auto-registered test accounts prefixed with zaptest_ on the pentest.invalid domain. Real user accounts and production data are never modified.

Related Skills

Explore More Software Engineering Skills→
Renzo-TognellaRenzo-Tognella

integrating-dast-with-owasp-zap-in-pipeline

Automate OZAP DAST scans in CI/CD pipelines with GitHub Actions or GitLab CI.

Community
Advanced
zebbernzebbern
5

retest-vuln

Automates verification of vulnerability fixes through structured retest workflows.

Community
Advanced
SaturateSaturate

security-deep-dive

Analyze software security to identify vulnerabilities and attack surfaces.

Community
Advanced
dreadnodedreadnode
11

burp-suite

Automate Burp Suite Professional security testing via its MCP server.

Official
Intermediate