Run Authorized Nuclei Security Scans
Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "dast-nuclei" from https://skillstore.io/skills/agentsecops-dast-nuclei.md and its manifest at https://skillstore.io/api/skills/agentsecops-dast-nuclei/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "dast-nuclei". Plan a critical and high severity scan of an authorized staging application at 25 requests per second.
Expected outcome:
Using "dast-nuclei". Review a Nuclei report that claims a critical exposed administration panel.
Expected outcome:
The review checks authentication, response content, affected version, and mitigating controls before assigning a final severity and remediation owner.
Using "dast-nuclei". Design a custom check for an exposed application configuration endpoint.
Expected outcome:
The design uses a small request budget, status and content matchers, redacted evidence, a negative matcher, and an authorized local test case.
Most static alerts are false positives caused by Markdown fences, placeholder URLs, defensive examples, and detection-rule literals. Confirmed risks include remote pipe-to-shell execution, token access by mutable CI actions, sensitive credential extraction, unrestricted targets, and command-line secret exposure. No prompt injection, obfuscation, or malicious exfiltration intent was found.
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
https://skillstore.io/skills/agentsecops-dast-nuclei/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/agentsecops-dast-nuclei?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/agentsecops-dast-nuclei?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-dast-nuclei/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/agentsecops-dast-nuclei.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>AgentSecOps. (2026). dast-nuclei security audit report (audit version 9) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-dast-nuclei/audits/9@techreport{agentsecops-agentsecops-dast-nuclei-2026,
author = {AgentSecOps},
title = {dast-nuclei security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/agentsecops-dast-nuclei/audits/9},
note = {Author version 0.1.0}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dast-nuclei security audit report (audit version 9)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-dast-nuclei/audits/9"
identifiers:
- type: other
value: "skillstore:agentsecops-dast-nuclei:audit:9"
description: "Skillstore immutable audit report identifier"
Run scoped CVE, OWASP, and misconfiguration checks, then validate important findings before remediation.
Configure scheduled or pull-request scans with severity thresholds, SARIF uploads, and retained artifacts.
Create focused Nuclei templates with constrained requests, precise matchers, extractors, and local test targets.
Plan an authorized Nuclei scan for [target]. Use critical and high severities, a 25-request rate limit, and include validation steps.
Design an authorized scan for [application] using [authentication type]. Protect credentials, limit scope, and explain how to verify findings.
Design a Nuclei CI workflow for [repository]. Pin dependencies, validate approved targets, upload SARIF, and fail only on verified policy thresholds.
Specify a Nuclei template for [vulnerability pattern]. Minimize requests, avoid destructive payloads, use precise matchers, and define a false-positive test plan.
Author
AgentSecOpsLicense
MIT
Author version
v0.1.0
Skillstore revision
r2
Ref
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
Maintenance freshness
7/24/2026
Usage
10 downloads · 241 views
Build pytm Threat Models as Code
Threat modeling often becomes outdated and disconnected from architecture changes. This skill helps create pytm models, STRIDE analysis, and diagram workflows for security reviews and CI.
Secure Dockerfiles with Hadolint
Dockerfile mistakes can create insecure and unreliable container images. This skill provides Hadolint workflows, rule guidance, remediation examples, and reusable CI configurations.
Audit Code with Semgrep
Security flaws can remain hidden across large, multilingual repositories. This skill guides focused Semgrep scans, triage, custom rules, CI gates, and standards-aligned remediation.
Scan Dependencies and Containers with Trivy
Security teams need consistent visibility into vulnerable components, images, and infrastructure configuration. This skill provides practical Trivy workflows for assessment, reporting, and remediation.
Automate OWASP ZAP DAST Scans
Security teams need repeatable runtime testing before releases. This skill guides authorized OWASP ZAP scans, authentication setup, API testing, and CI reporting.
Scan Python Code with Bandit
Python security flaws can reach production unnoticed. This skill guides Bandit scans, prioritization, CI integration, and remediation with CWE and OWASP references.
Analyze Project Security Risks
by Cornjebus
Security reviews are slow when dependency, container, and IaC data are spread across a repository. This skill inventories assets, checks OSV.dev, and drafts prioritized remediation reports.
Audit Code for Security Risks
by Barnhardt-Enterprises-Inc
Security-sensitive code is easy to ship with hidden flaws in authentication, input handling, and secrets. This skill gives Claude, Codex, and Claude Code structured security references and scanner guidance for safer reviews.
Audit Dependency Security and License Risk
by sickn33
Dependency risk is hard to prioritize across vulnerabilities, licenses, updates, and supply chain signals. This skill guides Claude, Codex, and Claude Code through structured audits and remediation plans.
Validate Project Security
by ByronWilliamsCPA
Security reviews can miss secrets, weak configuration, and dependency risk. This skill guides Claude, Codex, and Claude Code through structured checks and remediation planning.
Review Application Security Before Release
by sickn33
Teams can miss common security defects before deployment. This skill provides a structured checklist for secrets, input validation, auth, and testing.
Audit Firebase Security Rules
by firebase
Firestore rules can accidentally allow data leaks, role escalation, or unsafe updates. This skill guides Claude, Codex, and Claude Code through a focused review of access control and validation gaps.