The ZAP full scan is a script that is available in the ZAP Docker images. It runs the ZAP spider against the specified target (by default with no time limit) followed by an optional ajax spider scan and then a full active scan before reporting the results. This means that the script does perform actual ‘attacks’ and can potentially run for a long period of time.