CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/nuclei-dast

Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via `-t {path}` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j` for cross-tool finding aggregation, authors custom YAML matchers for app-specific checks, and gates CI on severity thresholds. Use when the team runs Nuclei alongside ZAP for template-driven DAST coverage, needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, command-dense skill with strong actionability, explicit validation/feedback loops for an active scanning tool, and clean one-level-deep progressive disclosure to two real reference files. The main weaknesses are minor: some inline content overlaps flags.md (conciseness) and a cross-reference error in Step 2 pointing readers to Step 6 for DOS info that actually lives in Step 8.

Suggestions

Fix the Step 2 cross-reference: change '(see Step 6)' to '(see Step 8)' since DOS-capable template handling is in Step 8, not the custom-template step.

Add a complete working YAML custom template example in Step 6 so the custom-template-authoring workflow is fully copy-paste ready rather than a structural field list.

Consider trimming the inline common-flags summary table or the 6,500+ template category list to reduce overlap with flags.md and tighten conciseness.

DimensionReasoningScore

Conciseness

Mostly command-dense and tool-specific, but the inline common-flags table duplicates flags.md and prose like 'Each line is one finding, ready for cross-tool aggregation' and 'Each template is a YAML file defining a request plus matchers...' could be tightened; the 6,500+ template category list is borderline unnecessary context.

2 / 3

Actionability

Copy-paste-ready commands at nearly every step: `go install -v ...nuclei@latest`, `nuclei -u https://staging.example.com -j -o nuclei-report.jsonl`, and the gating script `count=$(wc -l < nuclei-critical.jsonl); if [ "$count" -gt 0 ]; then echo "FAIL" >&2; exit 1; fi`; Step 6's custom template is a structural field list rather than a full YAML block but is detailed and paired with `nuclei -t ... -validate`.

3 / 3

Workflow Clarity

Clear Steps 1-9 sequence with explicit validation checkpoints and feedback loops: 'Validate: `nuclei -t ./custom-templates/custom-debug-endpoint.yaml -validate`', 'always -validate and smoke-test against known-vulnerable endpoint', and 'validate it a second time before reporting it' / 'Use -debug to confirm matcher fired'; the Step 2 '(see Step 6)' DOS pointer is a minor mislabel (DOS content lives in Step 8), not a missing validation step.

3 / 3

Progressive Disclosure

Two clearly-signaled one-level-deep references that both exist via markdown links — 'Full flag reference: [references/flags.md](references/flags.md)' and 'Full GitHub Actions workflow ...: [references/ci-integration.md](references/ci-integration.md)' — with inline summary tables complementing the full references and core template-authoring content kept inline because no separate file exists for it.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that pairs concrete CLI-flag-level actions with an explicit multi-branch 'Use when' trigger clause. It is distinctive against adjacent DAST tools (ZAP) and uses natural practitioner terms. No fluff or over-claims; verbosity is justified by specificity rather than padding.

DimensionReasoningScore

Specificity

Lists multiple concrete actions with actual CLI flags: 'selects templates via `-t {path}` and `-tags`/`-severity` filters', 'controls request rate with `-rl`', 'emits JSONL output via `-j`', 'authors custom YAML matchers', 'gates CI on severity thresholds' — far beyond vague language.

3 / 3

Completeness

Clearly answers both what ('installs and runs... template-based HTTP scanning', 'authors custom YAML matchers') and when via the explicit 'Use when the team runs Nuclei alongside ZAP... needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline.'

3 / 3

Trigger Term Quality

Good coverage of natural terms a user would say: 'Nuclei', 'DAST coverage', 'ZAP', 'fuzzing-style probes', 'CVE templates', 'CI', 'pipeline' — matching how practitioners request template-driven scanning.

3 / 3

Distinctiveness Conflict Risk

Clear niche (Nuclei template-driven DAST) explicitly distinguished from ZAP ('alongside ZAP', 'beyond ZAP passive scan'), with triggers unlikely to conflict with a separate ZAP skill.

3 / 3

Total

12

/

12

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

Total

15

/

16

Passed

Reviewed

Table of Contents