skills.rest
SensLiao
SensLiaoCOMMUNITY
Explore all skills by this author →
GitHub

dast-baseline-scanning

Run passive DAST scans on web applications with OWASP ZAP Baseline.

Updated May 28, 2026
Search Tags:#security scanning#DAST#OWASP ZAP#passive scanning#baseline assessment
One-click install
npx skills add https://github.com/SensLiao/Claude-code-setting --skill dast-baseline-scanning
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dast-baseline-scanning
Source: https://github.com/SensLiao/Claude-code-setting/tree/main/skills/dast-baseline-scanning
Command: npx skills add https://github.com/SensLiao/Claude-code-setting --skill dast-baseline-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires OWASP ZAP, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a secure and controlled method for performing passive DAST scanning to assess the security baseline of web applications.

Core Features & Use Cases

  • Passive DAST Scanning: Configures and runs OWASP ZAP Baseline scan against authorized targets.
  • Report Generation: Generates detailed reports with alerts and remediation proposals.
  • Authorization Pre-check: Ensures compliance with pre-defined security policies before scanning.
  • Wrapper-based Execution: Prevents direct ZAP CLI invocation to maintain security boundaries.

Quick Start

Run the dast-baseline-scanning skill on the staging server 'https://staging.example.com' and generate a report.

Frequently Asked Questions about dast-baseline-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is passive DAST scanning and how does it assess web application security baselines?▼

Passive DAST scanning observes web traffic without actively attacking the target to identify security baseline vulnerabilities. This Skill uses OWASP ZAP Baseline to analyze authorized, non-production targets and generate reports with remediation suggestions.

Can I use OWASP ZAP to run a baseline scan on a production web application?▼

No, OWASP ZAP baseline scanning via this Skill must target non-production environments. An authorization pre-check ensures compliance with security policies before scanning, preventing unintended disruption or policy violations on live production systems.

How do I generate a security baseline report for a staging server using OWASP ZAP?▼

To generate a security baseline report, run the Skill against your authorized staging target. It configures OWASP ZAP Baseline to perform passive scanning and produces a detailed report containing security alerts and remediation proposals.

Do I need to install OWASP ZAP and Python to perform passive DAST scanning?▼

Yes, performing passive DAST scanning with this Skill requires both the OWASP ZAP tool and a Python environment. These dependencies are necessary to execute the wrapper-based scanning logic and process the generated security findings.

Why does this passive DAST scanning approach use a wrapper instead of direct ZAP CLI invocation?▼

This passive DAST scanning approach uses a wrapper-based execution to prevent direct ZAP CLI invocation, maintaining strict security boundaries. It ensures scans only proceed after passing authorization pre-checks for non-production targets.

Related Skills

Explore More Software Engineering Skills→
AgentSecOpsAgentSecOps
183

dast-zap

Automate OWASP ZAP dynamic security scans for web applications and APIs.

Official
Advanced
CodySwannGTCodySwannGT
3

security-zap-scan

Run OWASP ZAP baseline security scans locally with Docker.

Community
Intermediate
jassicsjassics
6

sast-review

Triage SAST findings to rank true vulnerabilities and suggest remediation.

Community
Advanced
zzw4257zzw4257

OWASP ZAP

Scan web applications for security vulnerabilities using active and passive techniques.

Community
Intermediate