skills.rest
xotong
xotongCOMMUNITY
Explore all skills by this author →
GitHub

appsec-dast-sim

Simulate DAST security testing via static codebase analysis without running the application.

2|Updated May 8, 2026
Search Tags:#testing#security#owasp#ai#simulation#dast#wstg
One-click install
npx skills add https://github.com/xotong/claude-marketplace --skill appsec-dast-sim
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: appsec-dast-sim
Source: https://github.com/xotong/claude-marketplace/tree/main/plugins/appsec/skills/appsec-dast-sim
Command: npx skills add https://github.com/xotong/claude-marketplace --skill appsec-dast-sim

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates AI-assisted Dynamic Application Security Testing (DAST) simulations against codebases without requiring running applications, enabling design-time security assessments.

Core Features & Use Cases

  • Inventory endpoints and routes by static code analysis across common stacks.
  • Walk every OWASP WSTG v4.2 category and generate targeted probes, findings, and remediation guidance.
  • Produce actionable findings grouped by severity for governance, risk assessment, and security reviews.
  • Use Case: Teams can perform a comprehensive security review during development without deploying or containerizing the app.

Quick Start

Run the AI-driven DAST simulation against your codebase to generate actionable OWASP WSTG v4.2 findings

Frequently Asked Questions about appsec-dast-sim

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a DAST security test without deploying the application?▼

You can run AI-assisted DAST simulations against your codebase using static analysis to inventory endpoints and map OWASP WSTG categories without deploying or containerizing the app.

What is AI-assisted DAST simulation for codebase security validation?▼

AI-assisted DAST simulation automates security testing by statically analyzing source code and vendored materials to generate targeted probes, map OWASP WSTG v4.2 categories, and produce remediation guidance for design-time reviews.

Can I assess API and web app security during design-time without running the app?▼

Yes, design-time security assessments are possible by statically analyzing source code to inventory routes and apply OWASP WSTG v4.2 probes, yielding actionable findings grouped by severity for governance and risk assessment.

How do I map OWASP WSTG v4.2 categories to my codebase endpoints?▼

The simulation walks every OWASP WSTG v4.2 category, uses static code analysis across common stacks to inventory endpoints, and generates targeted probes with remediation guidance for each mapped category.

Does DAST simulation work with static source code instead of runtime environments?▼

Yes, the simulation requires only static analysis of source code and vendored reference materials to inventory endpoints and produce security findings, completely eliminating the need for a runtime environment.

When should I avoid using AI-driven DAST simulation?▼

Avoid AI-driven DAST simulation if you require runtime vulnerability validation or active exploitation, as it relies entirely on static code analysis to map OWASP WSTG categories and generate remediation guidance.

Related Skills

Explore More Software Engineering Skills→
buYoungbuYoung
18

code-security-audit

Audit codebases against OWASP ASVS 5.0.0 and generate Markdown security reports.

Community
Advanced
EojEdredEojEdred

security-hardening

Scan code and configurations for security vulnerabilities and replay risks.

Community
Intermediate
eliottbusinesseliottbusiness

requesting-code-review

Automate pre-commit code review with static analysis and security scanning.

Community
Advanced
hardw00thardw00t
90

android-pentest

Automate Android app pentesting with static APK analysis and Frida instrumentation.

Community
Advanced