nuclei-scan

Nuclei Scan Skill

Run a security vulnerability scan against the target URL using the built-in execute_nuclei_scan tool, and produce a structured security report.

Important: Before each tool call, output a short one-line description of what you are about to do (e.g. "Running smoke security scan on target URL"). This helps generate readable step-by-step reports.

Task wording: If the user asks for 基础 / 初步 / 基础安全漏洞 / 快速 / 冒烟 / CI 门禁-style coverage, assume they want time over breadth and use mode="smoke" (and state in the report that coverage is intentionally reduced). Only use mode="deep" when they ask for 全面 / 深度 / 穷尽 scans or comparable wording.

Prerequisites

• execute_nuclei_scan tool must be available (check the tool list).
• If it is missing, report: "安全扫描不可用：execute_nuclei_scan 工具未加载。"

Phase 1: Run the Scan

Call execute_nuclei_scan with the target URL. You do not need to write raw shell commands; the tool automatically handles nuclei subprocess execution, JSONL parsing, and result summarization.

Choose a smoke or deep mode based on the user's prompt.

Example:

{
  "url": "https://example.com",
  "scan_types": "xss,sqli,cve",
  "mode": "smoke"
}

Parameter notes:

• url — the exact target URL.
• scan_types — Comma-separated classes of vulnerabilities (cve,xss,sqli,misconfig,exposure).
• mode — "smoke" for a fast scan (omits OAST templates, shorter timeouts), "deep" for a comprehensive scan (slower).

Do not run a second full Nuclei scan against the same URL and the same (or broader) -tags just to “confirm how many hits there are” or to “see if there was only one finding.” The first scan's output is the source of truth.

Phase 2: Report

The execute_nuclei_scan tool returns a pre-formatted, translated text summary grouped by severity (Critical, High, Medium, Low, Info), including template IDs, names, and affected URLs.

Structure your final step response to the user by echoing this formatted text. For example: