nuclei

name	nuclei
description	Nuclei scan using only `temlists/` as the template root (no bundled projectdiscovery/nuclei-templates); framework-routed matrix and phase-isolated tags (`safe-poc` / `exploit`).
metadata	{"openclaw":{"emoji":"☢️","requires":{"bins":["nuclei"],"env":[]},"primaryEnv":null}}

Nuclei（分片漏洞扫描）

Safety

• Will not run Nuclei without a non-empty -l file of valid http(s):// URLs.
• Templates are physically routed by framework_hint into temlists/<framework>/.
• VULN_SCAN defaults to -tags safe-poc, EXPLOIT defaults to -tags exploit.
• No full-site unscoped template sweep.

Parameters

Param	Description
run_id	Required (same as pipeline)
chunk_index	1-based index matching manifest
chunk_path	Alternative: manifest path e.g. chunks/chunk_0001.txt
timeout	Per-chunk seconds (default 60; keep 20–40 typical)
rate_limit	Nuclei -rl。建议传正整数；兼容 low/medium/high（会映射为 10/30/80），默认 50
tags / nuclei_tags	Override manifest tags
framework_hint	Framework namespace hint: struts2, spring, thinkphp, jenkins, solr, elasticsearch, weblogic. Use the detected technology exactly.
mode	scan or exploit (drives tag isolation)
output_discovery_dir	Shared discovery dir, prefer clustered_targets.txt as list input

Results

Writes results/chunk_NNNN.jsonl and sets manifest chunk status to done or failed.

Docker

Build: pentest-skill-nuclei:latest via skills/docker-compose.yml (skill-nuclei). Image copies only temlists/; NUCLEI_TEMPLATES_DIR=/skill/temlists. No nuclei -update-templates / full community template tree in this skill.