testland/nuclei-dast
Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via `-t {path}` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j` for cross-tool finding aggregation, authors custom YAML matchers for app-specific checks, and gates CI on severity thresholds. Use when the team runs Nuclei alongside ZAP for template-driven DAST coverage, needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
Flagged because the skill explicitly installs and updates Nuclei at runtime (e.g., "go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest" and "nuclei -update-templates"), which fetches and installs remote executable code and pulls community templates from github.com/projectdiscovery/nuclei-templates (see https://github.com/projectdiscovery/nuclei/releases), meaning externally-hosted content will be fetched and directly controls scanner behavior or executes code during runtime.
Where we found it
github.[REDACTED]@latest
dependency · 6 sites
The plugin instructs the agent to install the Nuclei binary via four alternative vectors (go install @latest, brew, docker pull, precompiled binary download), all pulling unverifiable executable code at runtime.
github.com/projectdiscovery/nuclei-templates
dependency · 5 sites
The `nuclei -update-templates` command fetches the community template library from github.com/projectdiscovery/nuclei-templates at runtime; these templates directly control scanner behavior (request paths, matchers, payloads).
SKILL.md
66
nuclei -update-templates
281
nuclei -update-templates
304
Template coverage is only as current as the last `nuclei -update-templates`
322
github.com/projectdiscovery/nuclei-templates - community template library
references/ci-integration.md
17
run: nuclei -update-templates
actions/checkout@v5
dependency · 1 site
The CI workflow invokes a GitHub Action (actions/checkout@v5) as a remote dependency that executes code in the pipeline.
references/ci-integration.md
11
- uses: actions/checkout@v5
actions/upload-artifact@v4
dependency · 1 site
The CI workflow invokes a GitHub Action (actions/upload-artifact@v4) as a remote dependency that executes code in the pipeline.
references/ci-integration.md
33
- uses: actions/upload-artifact@v4
github/codeql-action/upload-sarif
dependency · 1 site
The plugin instructs the agent to use the github/codeql-action/upload-sarif GitHub Action to upload SARIF results, which is a hosted-actor dependency invoked at runtime in CI.
references/ci-integration.md
42
Use `-se nuclei.sarif` and the `github/codeql-action/upload-sarif` action to
- Audited
- Security analysis