agent failed to parse ZAP XML report; findings list came back empty

TL;DR

ZAP's XML report nests each alert inside site, then alerts, then alertitem elements, so flat tag lookups find nothing. Walk the tree depth-first to every alertitem node, extract the alert, riskcode, and description fields, and stream-parse with iterparse for large reports instead of loading the whole file into memory.

agent failed to parse ZAP XML report; findings list came back empty

Use this when

• Your agent parses a ZAP XML report and returns zero findings while ZAP's UI shows alerts.
• The report file is non-empty and opens fine in a text editor.
• You run ZAP in automation and consume the report programmatically.

Not for this skill when

• ZAP found no alerts. An empty alert section is a clean scan, not a parse failure. Check the site's alert count in the report header first.
• You asked for an HTML or JSON report. Those have different structures and different parsers.
• You are scanning a target outside your authorized scope. Fix the scope, not the parser.

Steps

1. Confirm the report has alerts: count occurrences of the alertitem element with grep -c "alertitem" report.xml. Verify: the count is greater than zero while your parser returns zero.
2. Inspect the nesting once: print the path from the root to the first alertitem (site, then alerts, then alertitem). Verify: you can state the exact path your parser must walk.
3. Rewrite the parser to walk that path and read the alert, riskcode, confidence, and description children of each alertitem. Verify: the extracted count matches the grep count from step 1.
4. For reports over ~50 MB, switch to streaming iterparse and clear processed site subtrees as you go. Verify: peak memory stays flat while the alert count still matches.
5. Write the findings to a JSON file before any summarization step. Verify: rerunning the parser on the same report reproduces the same list.

Variant phrasings

parse OWASP ZAP XML report empty alerts

Common phrasing.

zap xml report parser returns no findings

Symptom-level search.

agent extracting alerts from ZAP XML report

Agent-workflow phrasing.

Compatibility: ZAP 2.12+, XML report format. The three-level nesting has been stable across recent ZAP versions.

Why it happens

The report schema groups alerts per scanned site, so a parser that searches the whole document for alert elements at the top level, or that treats the first alerts container as the findings list, returns nothing. Agents that read XML with generic "find all text" helpers hit the same wall because the alert text lives two containers down.

Edge cases / pitfalls

• Reports from the baseline and full-scan automation plans use the same schema, but the spider-only plan may emit sites with empty alert sections. Skip empties; do not error on them.
• riskcode is a number (0 to 3), not a label. Map it to informational, low, medium, high in your own code.
• If the XML declares an encoding that does not match the actual bytes, open it as bytes and let the parser detect it rather than pre-decoding with the wrong codec.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_OPBQWOCvy5hnDBobk2bRHw