菜单
[recon/exploit] Template-driven vulnerability & misconfig scanner over live URLs (CVEs, exposures, default creds, takeovers). Reach for it for fast, broad, signature-based coverage once you have a live-host list.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
| name | nuclei |
| description | [recon/exploit] Template-driven vulnerability & misconfig scanner over live URLs (CVEs, exposures, default creds, takeovers). Reach for it for fast, broad, signature-based coverage once you have a live-host list. |
ProjectDiscovery's nuclei (pure-Go). Runs a large community + custom template
library against live targets to flag known CVEs, misconfigurations, exposures,
and default credentials. Breadth-first signal that focuses the deeper, tool- and
agent-specific exploitation.
.git, config leaks, subdomain takeover).-u <url> / -l <file> targets (use the httpx live list).-t <path> specific templates/dirs; -tags cve,exposure; -severity critical,high.-rl <n> rate limit (global req/sec); -c <n> concurrency; -timeout <s>.-jsonl -o out.jsonl structured output (prefer for the findings sink).-etags dos,fuzz exclude noisy/aggressive tags; -itags include.-H 'Cookie: ...' auth for gated endpoints. Experimental -ai "<prompt>" generates a template on the fly.# High/critical CVEs + exposures over live hosts, rate-limited, JSONL out
nuclei -l live-hosts.txt -tags cve,exposure -severity critical,high,medium \
-etags dos,intrusive -rl 30 -c 25 -timeout 10 -jsonl -o nuclei.jsonl
-rl modest and exclude dos/intrusive
tags unless the Rules of Engagement explicitly permit aggressive checks.