dast-zap

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains CI/workflow and runtime commands that fetch and execute external code — e.g. GitHub Actions referenced as uses: zaproxy/action-baseline (https://github.com/zaproxy/action-baseline) and Docker images pulled as zaproxy/zap-stable (docker.io/zaproxy/zap-stable) — which are retrieved at runtime and run code in CI/docker environments.