# Nuclei

> Use for templated vulnerability checks, exposure validation, and misconfiguration review during authorized pentests. Trigger on confirming likely web, network, or cloud exposures after discovery has narrowed the target set.

- Skill: `timsonner/nuclei` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/nuclei`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/nuclei/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/nuclei

---


# Nuclei

## Purpose

Use this skill for focused templated checks after discovery and target prioritization are already complete.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to confirm common exposures or misconfigurations on a narrowed target set.
- Need repeatable checks during retest.
- Need to compare similar assets consistently.

## Avoid When

- Templates have not been reviewed for safety or relevance.
- Broad scanning would create unnecessary noise or risk.
- A critical issue would be reported without manual confirmation.

## Inputs

- Confirmed targets and relevant technology context
- Approved template classes and exclusions
- Evidence threshold for manual confirmation

## Procedure

1. Select only template classes relevant to the current hypothesis and scope.
2. Run on the smallest possible target set.
3. Triage results for false positives and duplicate observations.
4. Manually confirm material findings before elevating severity.
5. Preserve the template context so retests can reproduce the same check safely.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Scan a single target with default templates
nuclei -u https://portal.contoso.com -o contoso-nuclei.txt

# Scan a list of live hosts
nuclei -l contoso-live.txt -o contoso-nuclei.txt

# Limit to medium severity and above
nuclei -l contoso-live.txt -severity medium,high,critical -o contoso-findings.txt

# Run exposure-only templates
nuclei -l contoso-live.txt -t exposures/ -o contoso-exposures.txt

# CVE-tagged templates only
nuclei -l contoso-live.txt -tags cve -o contoso-cves.txt

# Rate-limited scan to reduce alert noise
nuclei -l contoso-live.txt -rate-limit 10 -o contoso-rl.txt

# Authenticated scan with custom header
nuclei -u https://portal.contoso.com -H "Authorization: Bearer <token>" -o contoso-auth.txt
```

## Evidence to Capture

- Target, template, and timestamp mapping
- Manually confirmed exposures
- False positive patterns worth excluding later

## Safety Boundaries

- Review template behavior before use.
- Prefer safe, read-oriented validation where possible.
- Stop if a template behaves more aggressively than intended.