Add standalone script LlmAlertExplainer.js

[abliteration-ai]

Adds a standalone script that sends ZAP alerts to an OpenAI-compatible chat completions endpoint and prints an explanation plus remediation guidance for each alert. It's handy for triaging scan results or drafting report text straight from the Script Console.

Details:

• Alerts are read via ExtensionAlert.getAllAlerts(), following the pattern of the existing standalone/Loop through alerts.js.
• Outbound HTTP uses the Paros HttpSender/HttpMessage classes, the same mechanism as encode-decode/CyberChefExample.js and extender/arpSyndicateSubdomainDiscovery.js, so it respects ZAP's network/proxy settings.
• The base URL, API key environment variable, and model are configurable at the top of the script. It defaults to the Abliteration.ai API (https://api.abliteration.ai/v1, key in ABLIT_KEY, model abliterated-model), with comments showing how to point it at OpenAI, Ollama, LM Studio, or any other OpenAI-compatible server.
• A SITE_FILTER setting limits explanations to alerts of a single site and MAX_ALERTS caps the number of API calls per run.

Syntax checked with node --check and formatted with prettier per the repo's spotless config. I couldn't run it inside ZAP itself, so it sticks to patterns already proven in other scripts in this repo.

[psiinon]

Checkmarx One – Scan Summary & Details – 1c7a38c5-8895-4c9e-bb32-25908409c477

---

New Issues (10)

High: 2 · Medium: 2 · Low: 6

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Cx2c9af752-2171	Maven-com.fasterxml.jackson.core:jackson-core-2.17.0	details Recommended version: 2.18.8 Description: The fix released in jackson-core `2.18.6` and `2.21.1` for [GHSA-72hv-8253-57qq] (Number Length Constraint Bypass in Async Parser, published 2026-0... Attack Vector: NETWORK Attack Complexity: LOW ID: 75DtVs6JsdRgbdvOAmpnjVqN2ClMBFCGwjE3wvIWhJ4%3D Vulnerable Package
2		Last User Is 'root'	/docker-wrapper: 10	details Leaving the last user as root can cause security risks. Change to another user after running the commands that need privileges ID: 48tNdC6UziXyOGUccQZn3tPPzi4%3D
3		Hardcoded_Password_in_Connection_String	other/api/sdlc-integration/core/scan_module/scan.py: 219	details The application contains hardcoded connection details, "PASS: ", at line 219 of /other/api/sdlc-integration/core/scan_module/scan.py. This conn... ID: RfH501%2BGBhzDKnpWNTvev7Dh3PI%3D Attack Vector
4		Use_of_Broken_or_Risky_Cryptographic_Algorithm	payloadgenerator/associated_fields.py: 34	details In , the application protects sensitive data using a cryptographic algorithm, hexdigest, that is considered weak or even trivially broken, in /payl... ID: CNnVh4l8dtrFt9tVEtyvzAiIUj4%3D Attack Vector
5		Filtering_Sensitive_Logs	other/api/sdlc-integration/core/scan_module/scan.py: 218	details The application logs various user events, and in method  writes sensitive user details to debug, in /other/api/sdlc-integration/core/scan_module/... ID: f1QRvd8xqh2n2ezWthALlCYkFNQ%3D Attack Vector
6		Filtering_Sensitive_Logs	other/api/sdlc-integration/core/scan_module/scan.py: 243	details The application logs various user events, and in method  writes sensitive user details to debug, in /other/api/sdlc-integration/core/scan_module/... ID: uf0EptdYss5QBLs7bsp98aS6sqk%3D Attack Vector
7		MAINTAINER Instruction Being Used	/docker-wrapper: 3	details The MAINTAINER instruction sets the Author field of the generated images. The LABEL instruction is a much more flexible version of this and you sh... ID: nlHBIHIr9RZHoVXOgGxJ9hQCHFA%3D
8		Unpinned Actions Full Length Commit SHA	/codeql.yml: 31	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: z89ONTXYaYdPcNUEzfFqPVDqGfU%3D
9		Unpinned Actions Full Length Commit SHA	/codeql.yml: 34	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: wmF9HbZcEd4Px83a0Vg%2BO%2F%2B%2B4BU%3D
10		Unpinned Actions Full Length Commit SHA	/codeql.yml: 35	details Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA help... ID: ivv4LqDvobLaIQBf4po7RJO0z9E%3D

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.

[kingthorin]

I couldn't run it inside ZAP itself

What was the issue?

[abliteration-ai]

No error — I just didn't have a ZAP instance handy in my environment, so I validated against the patterns in existing merged scripts plus a syntax check instead of a live console run. Happy to test it properly if there's an easy headless way, or adjust anything you'd like.

(The Checkmarx findings are all in files this PR doesn't touch.)

[kingthorin]

Ya you can ignore those, that's okay.

[psiinon]

We're about to release an LLM add-on.
This handles the LLM configuration.
https://github.com/zaproxy/zap-extensions/tree/main/addOns/llm
It should be easy to add this feature to the alertfilter add-on as that already has an LLM feature:
https://github.com/zaproxy/zap-extensions/tree/main/addOns/alertFilters/src/main/java/org/zaproxy/zap/extension/alertFilters/llm
We dont want users to have to configure LLM settings in multiple places