# Run Authorized Nuclei Security Scans

Known vulnerabilities and misconfigurations can escape manual review. This skill guides authorized Nuclei scans, template selection, validation, and reporting.

## Install

```bash
npx skillstore add agentsecops/dast-nuclei
```

## Metadata

- Status: approved
- Slug: agentsecops-dast-nuclei
- Version: 0.1.0
- Author version: 0.1.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: c385f2e9d506e928f190a94982083751821eb7b42afa0b7c9cebd9ca51d6b35f
- Author: AgentSecOps
- GitHub username: AgentSecOps
- License: MIT
- Repository: https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/appsec/dast-nuclei
- Ref: 9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: blocked
- Manual install advisory: allowed\_with\_warning
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access, scripts
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/agentsecops-dast-nuclei
- Manifest: https://skillstore.pages.dev/api/skills/agentsecops-dast-nuclei/manifest

## Capabilities

- Provides Nuclei commands for single targets, target lists, severity filters, tags, rate limits, and concurrency.
- Guides authenticated scans with bearer tokens, cookies, API keys, OAuth, SAML, and MFA examples.
- Supplies CI workflow templates for scheduled scans, artifact uploads, SARIF reporting, and notifications.
- Explains custom HTTP, DNS, and network templates with matchers, extractors, workflows, and fuzzing.
- Maps findings to OWASP Top 10 and CWE categories with verification and remediation guidance.
- Provides false-positive triage methods using filters, stronger matchers, manual verification, and suppression records.

## Use Cases

- Triage Application Exposure: Run scoped CVE, OWASP, and misconfiguration checks, then validate important findings before remediation.
- Add CI Security Gates: Configure scheduled or pull-request scans with severity thresholds, SARIF uploads, and retained artifacts.
- Develop Custom Checks: Create focused Nuclei templates with constrained requests, precise matchers, extractors, and local test targets.

## Prompt Templates

### Plan a Basic Scan

```
Plan an authorized Nuclei scan for [target]. Use critical and high severities, a 25-request rate limit, and include validation steps.
```

### Plan an Authenticated Scan

```
Design an authorized scan for [application] using [authentication type]. Protect credentials, limit scope, and explain how to verify findings.
```

### Design a CI Workflow

```
Design a Nuclei CI workflow for [repository]. Pin dependencies, validate approved targets, upload SARIF, and fail only on verified policy thresholds.
```

### Develop a Custom Template

```
Specify a Nuclei template for [vulnerability pattern]. Minimize requests, avoid destructive payloads, use precise matchers, and define a false-positive test plan.
```

## Limitations

- Nuclei must be installed separately, and the helper scripts cited by the documentation are not included.
- Active scans can affect target availability and always require explicit authorization, scope controls, and suitable rate limits.
- Automated findings require manual validation and do not prove exploitability or business impact.
- Authenticated examples handle sensitive tokens that may appear in process arguments, logs, or scan results.

## Best Practices

- Verify written authorization, target ownership, and exclusions before every scan.
- Start with low request rates and concurrency, then monitor application health before increasing load.
- Restrict scan results, redact credentials, and manually validate critical or high findings.

## Anti Patterns

- Do not scan third-party, production, private, or link-local targets without explicit approval.
- Do not place credentials in shared command histories, logs, templates, or unrestricted artifacts.
- Do not treat an automated match as proof of exploitability or confirmed business impact.

## Security Audit

- Audited at: 2026-07-23T05:29:15.369\+00:00
- Summary: Most static alerts are false positives caused by Markdown fences, placeholder URLs, defensive examples, and detection-rule literals. Confirmed risks include remote pipe-to-shell execution, token access by mutable CI actions, sensitive credential extraction, unrestricted targets, and command-line secret exposure. No prompt injection, obfuscation, or malicious exfiltration intent was found.

## Stats

- Views: 241
- Downloads: 18
- Favorites: 0
- Popularity score: 0