CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/nuclei-dast

Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: selects templates via `-t {path}` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j` for cross-tool finding aggregation, authors custom YAML matchers for app-specific checks, and gates CI on severity thresholds. Use when the team runs Nuclei alongside ZAP for template-driven DAST coverage, needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline.

72

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A strong operational skill body: fully executable commands and a complete custom-template example, a clearly sequenced nine-step workflow with validation checkpoints, and exemplary use of two real, well-signaled reference files. The only weaknesses are minor — slight redundancy around rate-limiting notes and no explicit validate-fail/retry feedback loop.

Suggestions

State the rate-limit guidance once (Step 8) and have Step 3's flag table simply link to references/flags.md, removing the duplicated `-rl` default and rate-cap note.

Add an explicit feedback loop to Step 6, e.g., 'If `-validate` reports errors, fix the YAML and re-run `-validate` until it passes before scanning.'

Drop the repeated 'Per [nuclei-running][nuclei-running]' citation boilerplate from individual steps; the consolidated References section already covers source attribution.

DimensionReasoningScore

Conciseness

The body is efficient — commands, flag tables, and a minimal template dominate, with little explanation of concepts Claude already knows. Minor trimmable redundancy remains (the `-rl` default and rate-cap note appear in both Step 3 and Step 8, and the 'Per [nuclei-running]' citation boilerplate recurs across sections), matching anchor 4 rather than the fully lean anchor 5.

4 / 5

Actionability

Nearly everything is copy-paste executable: install commands for four methods, scan invocations with real flags, a working shell severity gate (`count=$(wc -l < nuclei-critical.jsonl); … exit 1`), a complete valid custom YAML template, `-validate` usage, and a full CI sequence in Step 9 plus a complete GitHub Actions workflow in references/ci-integration.md. Examples cover the common cases (first scan, CI gate, tag selection, custom template, rate limiting), matching anchor 5.

5 / 5

Workflow Clarity

Steps 1–9 form a clear install → scan → filter → author → integrate sequence with validation checkpoints (`-validate` before running, CI gate counting, smoke-test guidance in Limitations, FAQ re-validation advice). It falls short of anchor 5 because there is no explicit error-recovery feedback loop — e.g., what to do when `-validate` fails or a scan errors mid-run — leaving a minor validation gap at anchor 4.

4 / 5

Progressive Disclosure

The overview body is lean and both bundle files exist and are well-signaled one level deep: 'Full flag reference …: references/flags.md' and 'Full GitHub Actions workflow …: references/ci-integration.md', each holding the bulk content (complete flag table, full CI YAML) while the body keeps only the key subset inline. This matches anchor 5 (clear overview, well-signaled one-level-deep references, appropriate split).

5 / 5

Total

18

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An excellent description: it states concrete capabilities with real CLI flags, gives an explicit 'Use when' clause with natural trigger terms, and cleanly differentiates Nuclei's role from companion ZAP scanning. The only nit is missing generic synonyms like 'vulnerability scanning', which keeps trigger-term coverage just short of comprehensive.

DimensionReasoningScore

Specificity

The description enumerates five-plus concrete actions with actual flag names ("selects templates via `-t {path}` and `-tags`/`-severity` filters, controls request rate with `-rl`, emits JSONL output via `-j`", "authors custom YAML matchers", "gates CI on severity thresholds"), covering install through CI gating comprehensively. It exceeds anchor 4 ('minor gaps in coverage') because no capability area of the skill is left out.

5 / 5

Completeness

It explicitly answers 'what' ('Installs and runs ProjectDiscovery Nuclei template-based HTTP scanning: …' with enumerated capabilities) and 'when' ('Use when the team runs Nuclei alongside ZAP …, needs fuzzing-style probes beyond ZAP passive scan, or wants to operationalize community CVE templates in a pipeline'). Both are concrete and explicit with trigger phrases, matching anchor 5 exactly.

5 / 5

Trigger Term Quality

The 'Use when' clause supplies strong natural terms a user would actually say — 'Nuclei alongside ZAP', 'template-driven DAST coverage', 'fuzzing-style probes', 'community CVE templates', 'pipeline' — but broader synonyms such as 'vulnerability scanning' or 'security scanning' are absent. This matches anchor 4 (good coverage, a few natural terms missing) rather than 5 (comprehensive synonyms).

4 / 5

Distinctiveness Conflict Risk

It names the specific tool (Nuclei) and explicitly differentiates it from the closest sibling ('needs fuzzing-style probes beyond ZAP passive scan'), carving a clear template-driven-DAST niche. Trigger terms are tool-specific, so conflict risk with other skills is minimal — anchor 5.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents