From code-audit-suite
This skill should be used when the user asks to "run a DAST scan", "scan the running app", "run OWASP ZAP", "run Nuclei", "penetration test", "Web-App-Security prüfen", "Runtime-Security", "API security scan", "check security headers/injection on a live URL", or wants to test a running application for exploitable vulnerabilities. Runs OWASP ZAP + Nuclei in Docker against a URL, processed directly in Claude Code.
How this skill is triggered — by the user, by Claude, or both
Slash command
/code-audit-suite:dast-runtimeThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Dynamic, runtime security testing — the axis SonarQube structurally cannot
Dynamic, runtime security testing — the axis SonarQube structurally cannot reach, because it never executes the application. This skill attacks a running app and confirms what is actually exploitable:
.env, default credentials). New templates often land hours after a
disclosure.They are complementary on the same axis (ZAP = deep crawl/attack, Nuclei = broad known-issue templating), so both run.
Only scan applications you own or are explicitly authorized to test. ZAP's full scan actively attacks the target.
http://localhost:3000).~/.claude/skills/dast-runtime/scripts/scan.sh http://localhost:3000
zap-baseline.py).ZAP_FULL=1 scan.sh <url> runs the active attack (zap-full-scan.py).scan.sh <base-url> http://localhost:3000/openapi.json (uses
zap-api-scan.py).RESULT: PASS.localhost/127.0.0.1 in the URL are rewritten to host.docker.internal
automatically so the scanner containers reach the host-published app.nuclei-templates Docker volume; they
update on first use.scripts/scan.sh — runs ZAP (baseline/full/api) + Nuclei against a URL,
host-network aware, exit 1 on findings. Env: ZAP_FULL.npx claudepluginhub mguttmann/code-audit-suite --plugin code-audit-suiteProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.