dast-baseline-scanning

Run passive DAST scans on web applications with OWASP ZAP Baseline.

Updated May 28, 2026

Search Tags:#security scanning #DAST #OWASP ZAP #passive scanning #baseline assessment

Ready to run

npx skills add https://github.com/SensLiao/Claude-code-setting --skill dast-baseline-scanning

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dast-baseline-scanning
Source: https://github.com/SensLiao/Claude-code-setting/tree/main/skills/dast-baseline-scanning
Command: npx skills add https://github.com/SensLiao/Claude-code-setting --skill dast-baseline-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires OWASP ZAP, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a secure and controlled method for performing passive DAST scanning to assess the security baseline of web applications.

Core Features & Use Cases

Passive DAST Scanning: Configures and runs OWASP ZAP Baseline scan against authorized targets.
Report Generation: Generates detailed reports with alerts and remediation proposals.
Authorization Pre-check: Ensures compliance with pre-defined security policies before scanning.
Wrapper-based Execution: Prevents direct ZAP CLI invocation to maintain security boundaries.

Quick Start

Run the dast-baseline-scanning skill on the staging server 'https://staging.example.com' and generate a report.

Frequently Asked Questions about dast-baseline-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is passive DAST scanning and how does it assess web application security baselines?▼

Passive DAST scanning observes web traffic without actively attacking the target to identify security baseline vulnerabilities. This Skill uses OWASP ZAP Baseline to analyze authorized, non-production targets and generate reports with remediation suggestions.

Can I use OWASP ZAP to run a baseline scan on a production web application?▼

No, OWASP ZAP baseline scanning via this Skill must target non-production environments. An authorization pre-check ensures compliance with security policies before scanning, preventing unintended disruption or policy violations on live production systems.

How do I generate a security baseline report for a staging server using OWASP ZAP?▼

To generate a security baseline report, run the Skill against your authorized staging target. It configures OWASP ZAP Baseline to perform passive scanning and produces a detailed report containing security alerts and remediation proposals.

Do I need to install OWASP ZAP and Python to perform passive DAST scanning?▼

Yes, performing passive DAST scanning with this Skill requires both the OWASP ZAP tool and a Python environment. These dependencies are necessary to execute the wrapper-based scanning logic and process the generated security findings.

Why does this passive DAST scanning approach use a wrapper instead of direct ZAP CLI invocation?▼

This passive DAST scanning approach uses a wrapper-based execution to prevent direct ZAP CLI invocation, maintaining strict security boundaries. It ensures scans only proceed after passing authorization pre-checks for non-production targets.