| name | vuln-scanner |
| description | Advanced autonomous scanner with strategic sequencing and information chaining logic. |
| categories | ["security","dev-tools"] |
| dependencies | ["nuclei","python3","pip3","requests","sed","curl","unzip","ca-certificates","katana","trufflehog"] |
| setup_command | bash scripts/install.sh |
Nuclei Vulnerability Scanner (Strategic & Context-Aware)
1. Local Knowledge Base
- Skill Root:
./scripts/
- Templates Root:
../../Vuln_Templates
- Final Report Path:
/home/node/.openclaw/workspace/results/
2. Agent Operational Logic (Strategic Pentesting Flow)
The agent must act as a professional security researcher, prioritizing information gathering before deep exploitation.
Step 1: Recursive Intelligence Gathering
The template-encoded field in each JSONL entry must be ignored and never included in any output or displayed in chat.
- Inventory: Map all directories and templates within
../../Vuln_Templates.
- Description Analysis: Read the headers of every template/script to categorize them by Vulnerability Type and Required Inputs.
Step 2: Strategic Execution Planning (Chaining)
Do not execute in alphabetical order. Construct a Logical Chain based on the following:
- Information Gathering First: Prioritize templates that leak configuration, version info, or session data.
- Contextual Inheritance: If Step A discovers a valid username, JWT, or internal ID, the agent must carry this data forward to Step B's payloads.
- Efficiency Ranking: Group templates by vulnerability category. Start with lower-noise, higher-yield scans (e.g., Information Disclosure) to feed more intrusive tests (e.g., BAC, IDOR).
Important: Always invoke scan.sh per template file or per category directory — never pass the entire Vuln_Templates/ directory at once. Passing the whole directory causes Nuclei to run all templates simultaneously and bypasses the strategic sequencing above.
Example (correct):
bash scripts/scan.sh targets.txt ../../Vuln_Templates/Misconfiguration/
bash scripts/scan.sh targets.txt ../../Vuln_Templates/Broken_Access_Control/get-idor-read.yaml -var TARGET_ID=123
Example (incorrect):
bash scripts/scan.sh targets.txt ../../Vuln_Templates/
Step 3: Dynamic Payload Patching & JIT Modification
- Information Inheritance: If a prior scan result contains data usable in a subsequent template's placeholder, the agent must use the original template directly and inject the inherited data using runtime variables (e.g., Nuclei's
-var or -header flags). Critically important: Never modify the original template files under any circumstances. All source templates must remain in their original state to preserve the audit trail and vulnerability taxonomy.
- Just-In-Time (JIT) Setup: If a template's usage guide suggests a specific setup script (e.g., "Run this to generate an admin-level JWT"), execute it only when the strategic flow reaches that stage.
Step 3.5: Output Parsing & Target Evolution (The Feedback Loop)
- Data Extraction: After each Nuclei execution, the agent must parse
findings.jsonl. Specifically, look for extracted-results or patterns in the response to identify new session tokens, user IDs, or hidden parameters.
- Target List Expansion: If a scan reveals new internal paths or subdomains not present in the original
targets.txt, the agent must append these to the target list for subsequent, more specific templates.
Step 4: Adaptive Feedback & Re-sequencing
- Live Updates: If a scan yields new endpoints or parameters, the agent should re-scan the template directory to see if any previously ignored templates are now relevant.
- Failure Reasoning: If a high-priority scan fails, analyze if a missing "Information Piece" (like an expired token) was the cause, then backtrack to the appropriate "Auth Generator" or "Info Gatherer" before retrying.
Step 5: Post-Scan Housekeeping
- Artifact Management: Once a strategic chain is completed, maintain all execution logs and scan results as they are for record-keeping and audit purposes.
- Findings Cleanup: Do NOT modify
findings.jsonl directly. Post-processing and field cleanup is handled by the attack-scenario-gen skill's parse_jsonl.py script. Modifying the raw file will corrupt downstream processing.
- Final Synthesis: Combine all
summary.md files from the chain into a single "Strategic Attack Path Report."
3. Toolset for Agent
find / grep: For deep structural and metadata analysis.sed / python3: For complex data inheritance and payload modification.nuclei: The execution engine for the final strategic payload.
