CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/zap-authenticated-scans

Configures authenticated DAST sessions in ZAP - ZAP Context + Authentication Method (form, JSON, script, browser-based, HTTP/NTLM), Session Management strategy (cookie, header, script), Verification Strategy (regex indicators, poll-URL), CSRF token handling, OAuth/bearer header injection, logged-in/logged-out indicator calibration, and context XML export for use with `-n` in baseline and full scans. Use when the team needs DAST coverage of authenticated routes - the most common DAST gap and the hardest DAST setup to get right.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong, actionable build-an-X workflow with concrete code, a clear sequenced process, a validation checkpoint, and well-organized one-level-deep references. The main weakness is conciseness: repeated citation phrasings and a few restated doc sentences pad the token budget.

Suggestions

Collapse the repeated 'Per [zap-methods][zap-methods]' / 'Per [zap-auth][zap-auth]' provenance phrasings into a single 'Steps 2-6 follow [zap-methods]' note, citing the source once per section instead of per paragraph.

Remove sentences that restate ZAP doc prose verbatim (e.g., 'Cookie-Based "session is being tracked through cookies"') in favor of the actionable menu path or config value the reader actually needs.

Trim the Worked example or merge it into the How-to-use summary to reduce overlap with the step-by-step instructions.

DimensionReasoningScore

Conciseness

The body is mostly efficient and avoids explaining basic concepts, but ~330 lines with repeated citation phrasings ('Per [zap-methods][zap-methods]', 'Per [zap-auth][zap-auth]' appear many times) and a few restated doc sentences could be tightened, matching the 'mostly efficient but includes some unnecessary explanation or could be tightened' anchor rather than the lean 3.

2 / 3

Actionability

Provides fully executable, copy-paste-ready guidance: exact placeholder syntax ('username={%username%}&password={%password%}'), the `-config` credential-injection bash block, the `docker run` CI command, and the browser-based YAML config, plus specific menu paths like 'Session Properties > Contexts > Add'.

3 / 3

Workflow Clarity

Twelve steps are clearly sequenced with a 'How to use' summary mapping each action to step numbers, an explicit validation checkpoint ('Confirm auth in the Authentication Tester' before exporting in Step 11), and an anti-patterns table that supplies error-recovery guidance — matching the 'clear sequence with explicit validation steps; feedback loops for error recovery' anchor.

3 / 3

Progressive Disclosure

Core workflow is inline while the deepest detail is offloaded to three well-signaled, one-level-deep references ('See [references/script-based-auth.md]', oauth-bearer-injection.md, verification-strategy.md), all of which exist as real bundle files. Clear overview + appropriately split detail matches the top anchor.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, third-person, and complete with an explicit 'Use when' trigger clause. It names concrete ZAP auth capabilities and a distinct niche, with no over-claims or fluff.

DimensionReasoningScore

Specificity

Lists many concrete actions: 'Configures authenticated DAST sessions in ZAP', 'ZAP Context + Authentication Method (form, JSON, script, browser-based, HTTP/NTLM)', 'Session Management strategy', 'CSRF token handling', 'OAuth/bearer header injection', 'context XML export' — matching the 'Lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Explicitly answers both: what ('Configures authenticated DAST sessions in ZAP ...') and when ('Use when the team needs DAST coverage of authenticated routes'). Matches the 'Clearly answers both what AND when with explicit triggers' anchor.

3 / 3

Trigger Term Quality

Natural terms a DAST/security user would say appear explicitly: 'DAST coverage', 'authenticated routes', 'ZAP', 'baseline and full scans'. The clause 'Use when the team needs DAST coverage of authenticated routes' gives good coverage of natural trigger language; not merely technical jargon.

3 / 3

Distinctiveness Conflict Risk

The niche is sharply scoped to authenticated ZAP DAST session setup — a distinct trigger surface unlikely to fire for unrelated skills. It is clearly distinguishable from generic scanning or cadence skills.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents