SKILL: dast-authenticated

RED-LINE skill — planning / Read-only by design. Like pentest-scope-and-roe and security-pentest-recon-scan, this skill reads, plans, and explains; the project's validated-wrapper scripts run the scan and appsec-sdk persists evidence. It sits between passive dast-baseline-scanning and full exploitation, and is governed by the same double-gate as active pentest: a completed ROE (pentest-scope-and-roe) + a manual hard gate (authorized-pentest-validation). It never auto-scans and never bridges to exploitation on its own.

1. Mission

为已授权的 staging / preview / lab 目标提供登录态（authenticated）DAST 的包装化调用指导：

• ZAP Automation Framework（YAML-as-code plan.yaml）：authentication context（browser-based auth 优先）+ spider/ajax-spider 爬取 post-auth 页面 + scan
• Nuclei with session：带认证 header/cookie 的模板化扫描，覆盖登录后接口