integrating-dast-with-owasp-zap-in-pipeline

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs remote code at runtime by pulling and executing the Docker image "zaproxy/zap-stable" (and "zaproxy/zap-stable:latest") and by invoking GitHub Actions such as "zaproxy/action-baseline@v0.12.0", "zaproxy/action-full-scan@v0.12.0", and "zaproxy/action-api-scan@v0.12.0", which are required external runtime dependencies that execute remote code.