vuln-scanner

name	vuln-scanner
description	Advanced autonomous scanner with strategic sequencing and information chaining logic.
categories	["security","dev-tools"]
dependencies	["nuclei","python3","pip3","requests","sed","curl","unzip","ca-certificates","katana","trufflehog"]
setup_command	bash scripts/install.sh

Nuclei Vulnerability Scanner (Strategic & Context-Aware)

1. Local Knowledge Base

• Skill Root: ./scripts/
• Templates Root: ../../Vuln_Templates
• Final Report Path: /home/node/.openclaw/workspace/results/

2. Agent Operational Logic (Strategic Pentesting Flow)

The agent must act as a professional security researcher, prioritizing information gathering before deep exploitation.

Step 1: Recursive Intelligence Gathering

The template-encoded field in each JSONL entry must be ignored and never included in any output or displayed in chat.

• Inventory: Map all directories and templates within ../../Vuln_Templates.
• Description Analysis: Read the headers of every template/script to categorize them by Vulnerability Type and Required Inputs.

Step 2: Strategic Execution Planning (Chaining)

Do not execute in alphabetical order. Construct a Logical Chain based on the following:

1. Information Gathering First: Prioritize templates that leak configuration, version info, or session data.
2. Contextual Inheritance: If Step A discovers a valid username, JWT, or internal ID, the agent must carry this data forward to Step B's payloads.
3. Efficiency Ranking: Group templates by vulnerability category. Start with lower-noise, higher-yield scans (e.g., Information Disclosure) to feed more intrusive tests (e.g., BAC, IDOR).

Important: Always invoke scan.sh per template file or per category directory — never pass the entire Vuln_Templates/ directory at once. Passing the whole directory causes Nuclei to run all templates simultaneously and bypasses the strategic sequencing above.

Example (correct):

bash scripts/scan.sh targets.txt ../../Vuln_Templates/Misconfiguration/
bash scripts/scan.sh targets.txt ../../Vuln_Templates/Broken_Access_Control/get-idor-read.yaml -var TARGET_ID=123

Example (incorrect):

bash scripts/scan.sh targets.txt ../../Vuln_Templates/   # ← DO NOT DO THIS

Step 3: Dynamic Payload Patching & JIT Modification

• Information Inheritance: If a prior scan result contains data usable in a subsequent template's placeholder, the agent must use the original template directly and inject the inherited data using runtime variables (e.g., Nuclei's -var or -header flags). Critically important: Never modify the original template files under any circumstances. All source templates must remain in their original state to preserve the audit trail and vulnerability taxonomy.
• Just-In-Time (JIT) Setup: If a template's usage guide suggests a specific setup script (e.g., "Run this to generate an admin-level JWT"), execute it only when the strategic flow reaches that stage.

Step 3.5: Output Parsing & Target Evolution (The Feedback Loop)

• Data Extraction: After each Nuclei execution, the agent must parse findings.jsonl. Specifically, look for extracted-results or patterns in the response to identify new session tokens, user IDs, or hidden parameters.
• Target List Expansion: If a scan reveals new internal paths or subdomains not present in the original targets.txt, the agent must append these to the target list for subsequent, more specific templates.

Step 4: Adaptive Feedback & Re-sequencing

• Live Updates: If a scan yields new endpoints or parameters, the agent should re-scan the template directory to see if any previously ignored templates are now relevant.
• Failure Reasoning: If a high-priority scan fails, analyze if a missing "Information Piece" (like an expired token) was the cause, then backtrack to the appropriate "Auth Generator" or "Info Gatherer" before retrying.

Step 5: Post-Scan Housekeeping

• Artifact Management: Once a strategic chain is completed, maintain all execution logs and scan results as they are for record-keeping and audit purposes.
• Findings Cleanup: Do NOT modify findings.jsonl directly. Post-processing and field cleanup is handled by the attack-scenario-gen skill's parse_jsonl.py script. Modifying the raw file will corrupt downstream processing.
• Final Synthesis: Combine all summary.md files from the chain into a single "Strategic Attack Path Report."

3. Toolset for Agent

• find / grep: For deep structural and metadata analysis.
• sed / python3: For complex data inheritance and payload modification.
• nuclei: The execution engine for the final strategic payload.