CodySwannGT
CodySwannGT/lisa
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CodySwannGT/lisa --skill owasp-zapコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
This skill should be used for any non-trivial request — features, bugs, stories, epics, spikes, or multi-step tasks. It accepts a ticket URL (Jira, Linear, GitHub), a file path containing a spec, or a plain-text prompt. It assembles an agent team, breaks the work into structured tasks, and manages the full lifecycle from research through implementation, code review, deploy, and empirical verification.
any non-trivial request —…
This skill should be used for any non-trivial request — features, bugs, stories, epics, spikes, or multi-step tasks. It accepts a ticket URL (Jira, Linear, GitHub), a file path containing a spec, or a plain-text prompt. It assembles an agent team, breaks the work into structured tasks, and manages the full lifecycle from research through implementation, code review, deploy, and empirical verification.
SOC 職業分類に基づく
SKILL.md を表示中
| name | owasp-zap |
| description | running or interpreting an… |
OWASP ZAP (Zed Attack Proxy) performs DAST (Dynamic Application Security Testing) by scanning a running application for common security vulnerabilities from the OWASP Top 10.
# Requires Docker to be installed and running
bash scripts/zap-baseline.sh
The scan builds the Expo web export, serves it locally, and runs ZAP against it. Reports are saved to zap-report.html, zap-report.json, and zap-report.md.
ZAP findings are categorized by risk level:
| Risk | Action |
|---|---|
| High | Fix immediately — indicates exploitable vulnerability |
| Medium | Fix before deployment — security best practice violation |
| Low | Fix when convenient — minor security improvement |
| Informational | Review — may be false positive or acceptable risk |
script-src 'self' 'unsafe-inline' for hydration.frame-ancestors in CSP at CDN level.HttpOnly, Secure, and SameSite attributes.Server response header.ZAP scan rules are configured in .zap/baseline.conf. Each line controls how ZAP treats a specific rule:
IGNORE: Skip the rule entirelyWARN: Report finding but don't fail the buildFAIL: Fail the build if this finding is detectedZAP runs automatically in CI via the zap-baseline.yml workflow. Results are uploaded as artifacts and the build fails on medium+ severity findings.