Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on l
Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on l
Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on l
Creator · HoangNguyen0403
Last updated · Sep 5, 2026
Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on l
Do not auto-install
Install targets
Codex install prompt
Install the "common-dast-tooling" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-dast-tooling. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-dast-tooling","task":"Install common-dast-tooling","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Maintenance
fresh
Pushed today
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
561
74/100 Quality · 66/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
Pushed today
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
Agent should check
Copy prompt
Task: Use common-dast-tooling in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
LLM text format
/api/skills/hoangnguyen0403-common-dast-tooling/install?format=text
Find alternatives
/api/skills/search?q=common-dast-tooling&limit=3
Agent prompt
Use common-dast-tooling for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-dast-tooling
LLM text
/api/registry/manifest/hoangnguyen0403-common-dast-tooling?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-dast-tooling
Recommend
/api/registry/recommend?task=Use%20common-dast-tooling%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Browser automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASSPushed today
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Scrape, clean, and reuse web data
A practical workflow for agents that crawl public pages, extract clean content, normalize data, and hand it to downstream research or RAG workflows.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-dast-tooling description: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. metadata: triggers: keywords: - DAST - dynamic scan - zap - nuclei - nikto - curl probe - pentest - dynamic analysis - sqlmap - ffuf - mobile proxy --- # DAST Tooling Standard
## **Priority: P1 (HIGH)**
## Always-Apply Rules
- **No Scanning Production**: Never run DAST tools against live production environments. Use local or staging replicas only. - **No Uncapped Scans**: Always set `max-depth` or `max-duration` to avoid infinite loops on dynamic routes. - **No Anonymous Probing**: Use authenticated headers (`Authorization`) to test protected surfaces, not public ones. - **No Mobile on Real Devices in Prod**: Use emulators/simulators for mobile interception testing.
## 1. Backend / API Tools
### Scanner Tools See [implementation guide](references/implementation.md) for setup commands.
- **Nuclei**: Fast, template-based CVE/misconfiguration scanning. - **ZAP-CLI**: Deep spidering for SQLi, XSS, CSRF, session issues. - **Nikto**: Server configuration audit (version disclosure, headers). - **sqlmap**: Automated SQL injection detection and exploitation (suggest only — human confirms). - **ffuf / feroxbuster**: Content discovery and endpoint fuzzing.
### API-Specific Probing - **GraphQL**: Introspection query, nested query depth attack, field suggestion enumeration. - **gRPC**: `grpcurl` for service enumeration and method probing. - **WebSocket**: Connection hijacking, message injection testing.
## 2. Frontend / Web Tools
- **Browser DevTools**: Network tab for auth token leakage, console for client-side errors. - **Playwright/Puppeteer** (suggested): Automated DOM XSS detection, form submission, CSRF testing. - **Lighthouse**: Security/performance audit (CSP, HTTPS, mixed content). - **CSP Evaluator**: Validate Content-Security-Policy headers.
## 3. Mobile Interception Tools
- **mitmproxy / Burp Suite**: Proxy mobile traffic for API inspection. - **Frida**: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass. - **adb / xcrun simctl**: Device-level inspection, deep link testing, storage extraction. - **Objection**: Mobile runtime exploration (iOS/Android).
## 4. AI-Driven `curl` Probing (Manual Fallback)
When automated tools unavailable, generate targeted `curl` probes:
- **Bypassing Guards**: Probe with manipulated headers (`X-Forwarded-For`, `X-Custom-Auth`). - **Data Leakage**: Request `/metrics`, `/health`, `.git`, `/.env`, `/api-docs`. - **Parameter Tampering**: Modify payload types (String→Object), inject large payloads. - **JWT Manipulation**: Test with expired token, no token, modified claims.
See [implementation guide](references/implementation.md) for all commands.
## Scoring Impact
| Finding | Severity | Deduction | |---|---|---| | Unauthenticated access to private data | P0 | -25 | | Successful SQLi/RCE via probe | P0 | -20 | | Mobile API interception (no cert pin) | P1 | -15 | | DOM XSS confirmed via browser | P1 | -10 | | Info Leakage (Server versions/Env vars) | P1 | -10 | | Missing security headers (CSP/HSTS) | P2 | -5 |
## Anti-Patterns
- **No relying solely on static analysis**: Pentesting MUST include dynamic execution feedback. - **No ignoring non-web protocols**: Check Docker ports, SSH banners, gRPC/RMQ listeners. - **No skipping mobile**: If mobile app exists, proxy its traffic and inspect API calls.
## References
- [DAST Tooling Implementation](references/implementation.md) - [OWASP Dynamic Scanning Guide](https://owasp.org/www-community/Vulnerability_Scanning)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-dast-tooling, ready for a manual X post.
A practical pick for a web workflow: common-dast-tooling: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nucle... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x
Listing + install path for common-dast-tooling: https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsDo not auto-install
Install targets
Codex install prompt
Install the "common-dast-tooling" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-dast-tooling. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-dast-tooling","task":"Install common-dast-tooling","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Maintenance
fresh
Pushed today
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
561
74/100 Quality · 66/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
Pushed today
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
Agent should check
Copy prompt
Task: Use common-dast-tooling in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
LLM text format
/api/skills/hoangnguyen0403-common-dast-tooling/install?format=text
Find alternatives
/api/skills/search?q=common-dast-tooling&limit=3
Agent prompt
Use common-dast-tooling for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-dast-tooling
LLM text
/api/registry/manifest/hoangnguyen0403-common-dast-tooling?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-dast-tooling
Recommend
/api/registry/recommend?task=Use%20common-dast-tooling%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Browser automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASSPushed today
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Scrape, clean, and reuse web data
A practical workflow for agents that crawl public pages, extract clean content, normalize data, and hand it to downstream research or RAG workflows.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-dast-tooling description: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. metadata: triggers: keywords: - DAST - dynamic scan - zap - nuclei - nikto - curl probe - pentest - dynamic analysis - sqlmap - ffuf - mobile proxy --- # DAST Tooling Standard
## **Priority: P1 (HIGH)**
## Always-Apply Rules
- **No Scanning Production**: Never run DAST tools against live production environments. Use local or staging replicas only. - **No Uncapped Scans**: Always set `max-depth` or `max-duration` to avoid infinite loops on dynamic routes. - **No Anonymous Probing**: Use authenticated headers (`Authorization`) to test protected surfaces, not public ones. - **No Mobile on Real Devices in Prod**: Use emulators/simulators for mobile interception testing.
## 1. Backend / API Tools
### Scanner Tools See [implementation guide](references/implementation.md) for setup commands.
- **Nuclei**: Fast, template-based CVE/misconfiguration scanning. - **ZAP-CLI**: Deep spidering for SQLi, XSS, CSRF, session issues. - **Nikto**: Server configuration audit (version disclosure, headers). - **sqlmap**: Automated SQL injection detection and exploitation (suggest only — human confirms). - **ffuf / feroxbuster**: Content discovery and endpoint fuzzing.
### API-Specific Probing - **GraphQL**: Introspection query, nested query depth attack, field suggestion enumeration. - **gRPC**: `grpcurl` for service enumeration and method probing. - **WebSocket**: Connection hijacking, message injection testing.
## 2. Frontend / Web Tools
- **Browser DevTools**: Network tab for auth token leakage, console for client-side errors. - **Playwright/Puppeteer** (suggested): Automated DOM XSS detection, form submission, CSRF testing. - **Lighthouse**: Security/performance audit (CSP, HTTPS, mixed content). - **CSP Evaluator**: Validate Content-Security-Policy headers.
## 3. Mobile Interception Tools
- **mitmproxy / Burp Suite**: Proxy mobile traffic for API inspection. - **Frida**: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass. - **adb / xcrun simctl**: Device-level inspection, deep link testing, storage extraction. - **Objection**: Mobile runtime exploration (iOS/Android).
## 4. AI-Driven `curl` Probing (Manual Fallback)
When automated tools unavailable, generate targeted `curl` probes:
- **Bypassing Guards**: Probe with manipulated headers (`X-Forwarded-For`, `X-Custom-Auth`). - **Data Leakage**: Request `/metrics`, `/health`, `.git`, `/.env`, `/api-docs`. - **Parameter Tampering**: Modify payload types (String→Object), inject large payloads. - **JWT Manipulation**: Test with expired token, no token, modified claims.
See [implementation guide](references/implementation.md) for all commands.
## Scoring Impact
| Finding | Severity | Deduction | |---|---|---| | Unauthenticated access to private data | P0 | -25 | | Successful SQLi/RCE via probe | P0 | -20 | | Mobile API interception (no cert pin) | P1 | -15 | | DOM XSS confirmed via browser | P1 | -10 | | Info Leakage (Server versions/Env vars) | P1 | -10 | | Missing security headers (CSP/HSTS) | P2 | -5 |
## Anti-Patterns
- **No relying solely on static analysis**: Pentesting MUST include dynamic execution feedback. - **No ignoring non-web protocols**: Check Docker ports, SSH banners, gRPC/RMQ listeners. - **No skipping mobile**: If mobile app exists, proxy its traffic and inspect API calls.
## References
- [DAST Tooling Implementation](references/implementation.md) - [OWASP Dynamic Scanning Guide](https://owasp.org/www-community/Vulnerability_Scanning)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-dast-tooling, ready for a manual X post.
A practical pick for a web workflow: common-dast-tooling: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nucle... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x
Listing + install path for common-dast-tooling: https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsDo not auto-install
Install targets
Codex install prompt
Install the "common-dast-tooling" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-dast-tooling. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-dast-tooling","task":"Install common-dast-tooling","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Maintenance
fresh
Pushed today
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
561
74/100 Quality · 66/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
Pushed today
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
Agent should check
Copy prompt
Task: Use common-dast-tooling in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
LLM text format
/api/skills/hoangnguyen0403-common-dast-tooling/install?format=text
Find alternatives
/api/skills/search?q=common-dast-tooling&limit=3
Agent prompt
Use common-dast-tooling for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-dast-tooling
LLM text
/api/registry/manifest/hoangnguyen0403-common-dast-tooling?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-dast-tooling
Recommend
/api/registry/recommend?task=Use%20common-dast-tooling%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Browser automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASSPushed today
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Scrape, clean, and reuse web data
A practical workflow for agents that crawl public pages, extract clean content, normalize data, and hand it to downstream research or RAG workflows.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-dast-tooling description: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. metadata: triggers: keywords: - DAST - dynamic scan - zap - nuclei - nikto - curl probe - pentest - dynamic analysis - sqlmap - ffuf - mobile proxy --- # DAST Tooling Standard
## **Priority: P1 (HIGH)**
## Always-Apply Rules
- **No Scanning Production**: Never run DAST tools against live production environments. Use local or staging replicas only. - **No Uncapped Scans**: Always set `max-depth` or `max-duration` to avoid infinite loops on dynamic routes. - **No Anonymous Probing**: Use authenticated headers (`Authorization`) to test protected surfaces, not public ones. - **No Mobile on Real Devices in Prod**: Use emulators/simulators for mobile interception testing.
## 1. Backend / API Tools
### Scanner Tools See [implementation guide](references/implementation.md) for setup commands.
- **Nuclei**: Fast, template-based CVE/misconfiguration scanning. - **ZAP-CLI**: Deep spidering for SQLi, XSS, CSRF, session issues. - **Nikto**: Server configuration audit (version disclosure, headers). - **sqlmap**: Automated SQL injection detection and exploitation (suggest only — human confirms). - **ffuf / feroxbuster**: Content discovery and endpoint fuzzing.
### API-Specific Probing - **GraphQL**: Introspection query, nested query depth attack, field suggestion enumeration. - **gRPC**: `grpcurl` for service enumeration and method probing. - **WebSocket**: Connection hijacking, message injection testing.
## 2. Frontend / Web Tools
- **Browser DevTools**: Network tab for auth token leakage, console for client-side errors. - **Playwright/Puppeteer** (suggested): Automated DOM XSS detection, form submission, CSRF testing. - **Lighthouse**: Security/performance audit (CSP, HTTPS, mixed content). - **CSP Evaluator**: Validate Content-Security-Policy headers.
## 3. Mobile Interception Tools
- **mitmproxy / Burp Suite**: Proxy mobile traffic for API inspection. - **Frida**: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass. - **adb / xcrun simctl**: Device-level inspection, deep link testing, storage extraction. - **Objection**: Mobile runtime exploration (iOS/Android).
## 4. AI-Driven `curl` Probing (Manual Fallback)
When automated tools unavailable, generate targeted `curl` probes:
- **Bypassing Guards**: Probe with manipulated headers (`X-Forwarded-For`, `X-Custom-Auth`). - **Data Leakage**: Request `/metrics`, `/health`, `.git`, `/.env`, `/api-docs`. - **Parameter Tampering**: Modify payload types (String→Object), inject large payloads. - **JWT Manipulation**: Test with expired token, no token, modified claims.
See [implementation guide](references/implementation.md) for all commands.
## Scoring Impact
| Finding | Severity | Deduction | |---|---|---| | Unauthenticated access to private data | P0 | -25 | | Successful SQLi/RCE via probe | P0 | -20 | | Mobile API interception (no cert pin) | P1 | -15 | | DOM XSS confirmed via browser | P1 | -10 | | Info Leakage (Server versions/Env vars) | P1 | -10 | | Missing security headers (CSP/HSTS) | P2 | -5 |
## Anti-Patterns
- **No relying solely on static analysis**: Pentesting MUST include dynamic execution feedback. - **No ignoring non-web protocols**: Check Docker ports, SSH banners, gRPC/RMQ listeners. - **No skipping mobile**: If mobile app exists, proxy its traffic and inspect API calls.
## References
- [DAST Tooling Implementation](references/implementation.md) - [OWASP Dynamic Scanning Guide](https://owasp.org/www-community/Vulnerability_Scanning)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-dast-tooling, ready for a manual X post.
A practical pick for a web workflow: common-dast-tooling: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nucle... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x
Listing + install path for common-dast-tooling: https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsDo not auto-install
Install targets
Codex install prompt
Install the "common-dast-tooling" agent skill from https://github.com/HoangNguyen0403/agent-skills-standard/tree/develop/.agents/skills/common/common-dast-tooling. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"hoangnguyen0403-common-dast-tooling","task":"Install common-dast-tooling","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
Testing and QA
I need my agent to test a web app, reproduce bugs, and verify fixes.
Agent fit
Claude Code + Browser agents + CLI
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Maintenance
fresh
Pushed today
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
561
74/100 Quality · 66/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Do not auto-installTrust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Choose a stronger alternative or inspect the source manually before any install attempt.
Stars
561 GitHub stars
Repo activity
561 stars, 161 forks
Maintenance
Pushed today
License
MIT
Install
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill may drive a browser or interact with web pages.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
Agent should check
Copy prompt
Task: Use common-dast-tooling in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20common-dast-tooling%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install
Install command: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/hoangnguyen0403-common-dast-tooling/install
LLM text format
/api/skills/hoangnguyen0403-common-dast-tooling/install?format=text
Find alternatives
/api/skills/search?q=common-dast-tooling&limit=3
Agent prompt
Use common-dast-tooling for this task. Review https://www.openagentskill.com/api/skills/hoangnguyen0403-common-dast-tooling/install, then install with: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-toolingRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/hoangnguyen0403-common-dast-tooling
LLM text
/api/registry/manifest/hoangnguyen0403-common-dast-tooling?format=text
Install alias
/api/registry/install/hoangnguyen0403-common-dast-tooling
Recommend
/api/registry/recommend?task=Use%20common-dast-tooling%20in%20an%20agent%20workflow&limit=3
Agent fit
Browser automation
Platforms
Claude Code, Browser agents
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
Browser automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Trust Score v5 found insufficient evidence for agent installation. Treat this as discovery material, not an executable recommendation.
GitHub adoption
INFO561 GitHub stars
Stars/forks activity
INFO561 stars, 161 forks; issue activity unavailable in current metadata
Recent maintenance
PASSPushed today
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Choose a stronger alternative or inspect the source manually before any install attempt.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Operate web apps
I need my agent to control a browser, fill forms, and verify web app workflows.
Verify behavior
I need my agent to test a web app, reproduce bugs, and verify fixes.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Scrape, clean, and reuse web data
A practical workflow for agents that crawl public pages, extract clean content, normalize data, and hand it to downstream research or RAG workflows.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: common-dast-tooling description: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nuclei, Nikto, sqlmap, ffuf, browser automation, mobile proxy interception, and AI-driven curl probes. Use when advising on or running dynamic security scans on local/staging environments. metadata: triggers: keywords: - DAST - dynamic scan - zap - nuclei - nikto - curl probe - pentest - dynamic analysis - sqlmap - ffuf - mobile proxy --- # DAST Tooling Standard
## **Priority: P1 (HIGH)**
## Always-Apply Rules
- **No Scanning Production**: Never run DAST tools against live production environments. Use local or staging replicas only. - **No Uncapped Scans**: Always set `max-depth` or `max-duration` to avoid infinite loops on dynamic routes. - **No Anonymous Probing**: Use authenticated headers (`Authorization`) to test protected surfaces, not public ones. - **No Mobile on Real Devices in Prod**: Use emulators/simulators for mobile interception testing.
## 1. Backend / API Tools
### Scanner Tools See [implementation guide](references/implementation.md) for setup commands.
- **Nuclei**: Fast, template-based CVE/misconfiguration scanning. - **ZAP-CLI**: Deep spidering for SQLi, XSS, CSRF, session issues. - **Nikto**: Server configuration audit (version disclosure, headers). - **sqlmap**: Automated SQL injection detection and exploitation (suggest only — human confirms). - **ffuf / feroxbuster**: Content discovery and endpoint fuzzing.
### API-Specific Probing - **GraphQL**: Introspection query, nested query depth attack, field suggestion enumeration. - **gRPC**: `grpcurl` for service enumeration and method probing. - **WebSocket**: Connection hijacking, message injection testing.
## 2. Frontend / Web Tools
- **Browser DevTools**: Network tab for auth token leakage, console for client-side errors. - **Playwright/Puppeteer** (suggested): Automated DOM XSS detection, form submission, CSRF testing. - **Lighthouse**: Security/performance audit (CSP, HTTPS, mixed content). - **CSP Evaluator**: Validate Content-Security-Policy headers.
## 3. Mobile Interception Tools
- **mitmproxy / Burp Suite**: Proxy mobile traffic for API inspection. - **Frida**: Runtime instrumentation for cert pin bypass, biometric bypass, jailbreak detection bypass. - **adb / xcrun simctl**: Device-level inspection, deep link testing, storage extraction. - **Objection**: Mobile runtime exploration (iOS/Android).
## 4. AI-Driven `curl` Probing (Manual Fallback)
When automated tools unavailable, generate targeted `curl` probes:
- **Bypassing Guards**: Probe with manipulated headers (`X-Forwarded-For`, `X-Custom-Auth`). - **Data Leakage**: Request `/metrics`, `/health`, `.git`, `/.env`, `/api-docs`. - **Parameter Tampering**: Modify payload types (String→Object), inject large payloads. - **JWT Manipulation**: Test with expired token, no token, modified claims.
See [implementation guide](references/implementation.md) for all commands.
## Scoring Impact
| Finding | Severity | Deduction | |---|---|---| | Unauthenticated access to private data | P0 | -25 | | Successful SQLi/RCE via probe | P0 | -20 | | Mobile API interception (no cert pin) | P1 | -15 | | DOM XSS confirmed via browser | P1 | -10 | | Info Leakage (Server versions/Env vars) | P1 | -10 | | Missing security headers (CSP/HSTS) | P2 | -5 |
## Anti-Patterns
- **No relying solely on static analysis**: Pentesting MUST include dynamic execution feedback. - **No ignoring non-web protocols**: Check Docker ports, SSH banners, gRPC/RMQ listeners. - **No skipping mobile**: If mobile app exists, proxy its traffic and inspect API calls.
## References
- [DAST Tooling Implementation](references/implementation.md) - [OWASP Dynamic Scanning Guide](https://owasp.org/www-community/Vulnerability_Scanning)
Source provenance
Decision snapshot
561 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for common-dast-tooling, ready for a manual X post.
A practical pick for a web workflow: common-dast-tooling: Standardize dynamic application security testing for backend APIs, frontend web apps, and mobile clients. Covers ZAP, Nucle... 561 stars https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x
Listing + install path for common-dast-tooling: https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=x Install: npx skills add HoangNguyen0403/agent-skills-standard --skill common-dast-tooling
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to HoangNguyen0403 but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling/audit)
[](https://www.openagentskill.com/skills/hoangnguyen0403-common-dast-tooling?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)HoangNguyen0403
@hoangnguyen0403
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Do not auto-install
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsPermission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Usable metadata, review docs
Risk summary
Install readiness