ワンクリックでManusで任意のスキルを実行

nuclei

スター6

フォーク2

更新日2026年6月3日 05:58

[recon/exploit] Template-driven vulnerability & misconfig scanner over live URLs (CVEs, exposures, default creds, takeovers). Reach for it for fast, broad, signature-based coverage once you have a live-host list.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

tr4m0ryp

tr4m0ryp/shor

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

nuclei — templated vulnerability scanning

ProjectDiscovery's nuclei (pure-Go). Runs a large community + custom template library against live targets to flag known CVEs, misconfigurations, exposures, and default credentials. Breadth-first signal that focuses the deeper, tool- and agent-specific exploitation.

When to reach for it

After httpx, to sweep the live surface for known issues quickly.
To confirm a version-based CVE lead (target the matching template/tag).
For exposure checks (open panels, .git, config leaks, subdomain takeover).

Key flags

-u <url> / -l <file> targets (use the httpx live list).
-t <path> specific templates/dirs; -tags cve,exposure; -severity critical,high.
-rl <n> rate limit (global req/sec); -c <n> concurrency; -timeout <s>.
-jsonl -o out.jsonl structured output (prefer for the findings sink).
-etags dos,fuzz exclude noisy/aggressive tags; -itags include.
-H 'Cookie: ...' auth for gated endpoints. Experimental -ai "<prompt>" generates a template on the fly.

Safe invocation

# High/critical CVEs + exposures over live hosts, rate-limited, JSONL out
nuclei -l live-hosts.txt -tags cve,exposure -severity critical,high,medium \
  -etags dos,intrusive -rl 30 -c 25 -timeout 10 -jsonl -o nuclei.jsonl

Evidence to capture

Matched template id, matched-at URL, extracted data, severity — straight into a finding record (template id + location ≈ the stable fingerprint).
Treat single hits as leads: re-verify with a safe PoC before reporting confirmed.

Scope & rate caveats

Scan ONLY in-scope hosts/URLs. Keep -rl modest and exclude dos/intrusive tags unless the Rules of Engagement explicitly permit aggressive checks.
Keep templates updated, but pin a known template set per run for reproducible, diffable results across scans.
Some templates send real payloads — review tags; the no-DoS limit still applies.

このリポジトリの他の Skills

同じリポジトリ

jwt-tool

tr4m0ryp/shor

[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.

2026-06-066

naabu

tr4m0ryp/shor

[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.

2026-06-066

trivy

tr4m0ryp/shor

[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.

2026-06-066

semgrep

tr4m0ryp/shor

[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.

2026-06-066

trufflehog

tr4m0ryp/shor

[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.

2026-06-066

gitleaks

tr4m0ryp/shor

[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.

2026-06-066

nuclei — templated vulnerability scanning

When to reach for it

After httpx, to sweep the live surface for known issues quickly.

To confirm a version-based CVE lead (target the matching template/tag).

For exposure checks (open panels, .git, config leaks, subdomain takeover).

Key flags

-u <url> / -l <file> targets (use the httpx live list).

-t <path> specific templates/dirs; -tags cve,exposure; -severity critical,high.

-rl <n> rate limit (global req/sec); -c <n> concurrency; -timeout <s>.

-jsonl -o out.jsonl structured output (prefer for the findings sink).

-etags dos,fuzz exclude noisy/aggressive tags; -itags include.

-H 'Cookie: ...' auth for gated endpoints. Experimental -ai "<prompt>" generates a template on the fly.

Safe invocation

# High/critical CVEs + exposures over live hosts, rate-limited, JSONL out nuclei -l live-hosts.txt -tags cve,exposure -severity critical,high,medium \ -etags dos,intrusive -rl 30 -c 25 -timeout 10 -jsonl -o nuclei.jsonl

Evidence to capture

Matched template id, matched-at URL, extracted data, severity — straight into a finding record (template id + location ≈ the stable fingerprint).

Treat single hits as leads: re-verify with a safe PoC before reporting confirmed.

Scope & rate caveats

Scan ONLY in-scope hosts/URLs. Keep -rl modest and exclude dos/intrusive tags unless the Rules of Engagement explicitly permit aggressive checks.

Keep templates updated, but pin a known template set per run for reproducible, diffable results across scans.

Some templates send real payloads — review tags; the no-DoS limit still applies.

name	nuclei
description	[recon/exploit] Template-driven vulnerability & misconfig scanner over live URLs (CVEs, exposures, default creds, takeovers). Reach for it for fast, broad, signature-based coverage once you have a live-host list.