Skipfish

skipfish -o <out> <url>

Scans the web application with Skipfish, generating the surface report and findings with Google's crawler.

Run it when you want DAST with Google's crawler: Skipfish crawls the app at high speed (Google's optimized crawler) and generates the HTML report with findings — the discovered surface (routes, forms), vulnerabilities (injection, XSS, file inclusion), and configuration notes. It's the scanner for crawl efficiency: fast coverage of the app. In DevSecOps, Skipfish is one of the DAST options (or point-in-time scanning): the crawler report with surface findings.

Don't use it for the pipeline if ZAP is already there: ZAP is the reference option — Skipfish is one of the classics (development stopped; the project remained in Google's maintenance). Active scanning generates real traffic: the test environment is the site. And watch out: Skipfish findings need triage (scan false positives); and the HTML report is the deliverable (no native JSON format for the pipeline). DAST complements SAST: the app at runtime with the team's crawler.