# Automation Nuclei Templates

> Write custom nuclei templates to codify a finding into a repeatable, mass-scannable check. Load on "write a nuclei template", turning a manual bug into automation, checking a CVE across many hosts, or regression-scanning. Signals: a reproducible request→match, YAML templates, nuclei.

- Skill: `noorqureshi/automation-nuclei-templates` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/automation-nuclei-templates`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/automation-nuclei-templates/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/automation-nuclei-templates

---


# Custom nuclei templates

## When it applies
You confirmed a bug (or a CVE pattern) and want to (a) find every other affected host and
(b) keep a regression check. A nuclei template turns "one request + one match condition" into
a scalable, shareable detector.

## Why it works
nuclei runs declarative YAML: send request(s), assert matchers on the response. If your finding
is expressible as request→observable signal, it's a template — and then it scans thousands of
hosts consistently, no manual repetition.

## Method
1. **Capture the minimal repro**: the exact request and the unambiguous signal that proves the
   bug (status, a body string, a header, a reflected marker, response time).
2. **Write the template**: `id`, `info` (name/severity/tags), then `http:` with `method`,
   `path` (use `{{BaseURL}}`), any `payloads`, and `matchers` (`word`/`status`/`regex`/`dsl`).
   Use `matchers-condition: and` to avoid false positives; add an `extractor` to pull the proof.
3. **Reduce false positives**: match a signal unique to the vuln (a computed reflection, a
   specific error), not a generic 200; test against a known-good and known-bad host.
4. **Validate**: `nuclei -t mytemplate.yaml -u https://known-vuln` (should hit) and against a
   safe host (should not). Lint with `-validate`.
5. **Scale/share**: run across your live-hosts list; contribute non-sensitive templates upstream.

## Gotchas
- Overbroad matchers = noisy, untrusted results; require a signal that only the vuln produces.
- Interpolate `{{BaseURL}}`/variables correctly; hardcoded hosts don't scale.
- Destructive checks (writes/DoS) don't belong in a mass template — keep them read-only.

## Verify success
The template fires only on genuinely-affected hosts (true on the known-vuln, quiet on the
known-good) and extracts a clear proof.

## References
nuclei templating guide; nuclei-templates repo (examples); PDTM docs.