CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/nuclei-dast

Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via `-t {path}` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j` for cross-tool finding aggregation, authors custom YAML matchers for app-specific checks, and gates CI on severity thresholds. Use when the team runs Nuclei alongside ZAP for template-driven DAST coverage, needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline.

74

Quality

93%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, well-structured operational skill with executable examples at every step and appropriately offloaded reference files. Its main weakness is the absence of an explicit validate→fix→re-run feedback loop for an active scanning workflow, plus minor conciseness trims.

Suggestions

Add an explicit fix→re-validate loop in Step 6 (e.g., 'If `-validate` reports errors, edit the template and re-run `-validate` until it passes') to lift workflow_clarity into the top anchor for this active/destructive operation.

Tighten the Overview by removing the definitional sentence about what a template is, since the custom-template step already demonstrates it concretely.

Trim overlap between the 'When to use' list and the frontmatter description so the body adds criteria rather than restating them.

DimensionReasoningScore

Conciseness

Mostly efficient and actionable with sparing doc quotes, but mild over-explanation remains (e.g., 'Each template is a YAML file defining a request plus matchers that decide whether the response is a finding') and the 'When to use' section partially restates the frontmatter description.

4 / 5

Actionability

Provides copy-paste-ready, fully executable guidance throughout — install commands, a complete custom YAML template, a JSONL schema example, severity-gating bash with `wc -l` checks, and a referenced full GitHub Actions workflow — covering the common cases concretely.

5 / 5

Workflow Clarity

The 9-step sequence is clear with validation present (`-validate` in Step 6, `-debug` confirmation and smoke-testing in Step 8/Limitations, count-and-fail CI gate), but there is no explicit fix→re-validate feedback loop of the form 'if errors: fix and re-run', leaving a minor checkpoint gap for this active/destructive operation.

4 / 5

Progressive Disclosure

SKILL.md is a well-organized overview with clearly signaled, one-level-deep references to real bundle files — [references/flags.md](references/flags.md) for the full flag table and [references/ci-integration.md](references/ci-integration.md) for the full CI workflow — keeping the bulk-prone reference material off the main page while retaining the operational core inline.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that pairs concrete flag-level capabilities with an explicit 'Use when' trigger clause and clear differentiation from the companion ZAP skill. It is comprehensive without being padded.

DimensionReasoningScore

Specificity

Lists multiple concrete actions tied to specific flags — 'selects templates via `-t {path}` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j`', 'authors custom YAML matchers', 'gates CI on severity thresholds' — giving comprehensive coverage rather than vague abstraction.

5 / 5

Completeness

Explicitly answers both 'what' (installs/runs Nuclei, selects templates, rate-limits, emits JSONL, authors matchers, gates CI) and 'when' via a concrete 'Use when the team runs Nuclei alongside ZAP... needs fuzzing-style probes... or wants to operationalize community CVE templates in a pipeline' clause.

5 / 5

Trigger Term Quality

Covers natural terms a security team would actually say — 'Nuclei', 'ZAP', 'DAST', 'CVE templates', 'fuzzing-style probes', 'CI', 'pipeline' — including synonyms and the complementary-tool framing, with no significant natural phrasing missing.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (template-driven active DAST) explicitly differentiated from the companion ZAP passive scanner ('beyond ZAP passive scan', 'alongside ZAP'), so triggers are unlikely to fire for the wrong skill.

5 / 5

Total

20

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

referenced_paths_exist

Referenced path issues: 1 missing

Warning

Total

14

/

16

Passed

Reviewed

Table of Contents