# nuclei-suggest

Browse the nuclei-templates library, recommend a scoped template set for a given stack, target, or CVE, then run it against an authorized target and report findings.

- **Kind:** skill
- **Source:** https://github.com/forefy/.context
- **Page:** https://forefy.com/skills/87b50395-f6aa-4dde-8a00-560de2f59c87
- **API (JSON + files):** https://forefy.com/api/asr/87b50395-f6aa-4dde-8a00-560de2f59c87

---

## SKILL.md

---
name: nuclei-suggest
description: Browse the nuclei-templates library, recommend a scoped template set for a given stack, target, or CVE, then run it against an authorized target and report findings.
compatibility: nuclei-templates, nuclei binary
---

Use nuclei and templates to empower a bug bounty or pentest engagement hunt to the full capabilities of crowdsourced security. see `./references/install.md` for first installation of nuclei on the environment

# Methodology

1. Index once into id, path, severity, tags, tier, replicable; rebuild only when the templates tree mtime changes. See `references/browsing.md` for traversal.

2. Confirm scope before any run: in-scope hosts, desired posture (e.g. passive v.s. active scan), and whether OAST callbacks are workable within the enivronment.

3. Tier by blast radius from template contents: `file/`, `dns/`, `ssl/` and single benign GETs are safe; `intrusive`, `brute`, `fuzz`, `unsafe: true` and `interactsh` require extra user consideration; `code/` executes on your own host and should almost never be used. Honor `.nuclei-ignore` and never exceed the confirmed ceiling.

# Run preferences

Run the scoped set with `-duc` (disable the update check, which otherwise stalls scripted runs), `-jsonl -irr -store-resp -srd <dir>` for structured output plus captured request/response, `-etags` above the cap, `-rl` rate limiting, and a self-hosted OAST server if callbacks are permitted. On a target that returns a 200 catch-all (SPA app shell), prefer content/word matchers over status-only templates, which false-positive. Treat a skipped template as unrun, not clean.

# Output

Surface every finding, ranked by severity, with: its `template-id`; a full clickable template link, `https://github.com/projectdiscovery/nuclei-templates/blob/<sha>/<template-path>` where `<sha>` is `git -C <clone> rev-parse HEAD`, commit-pinned so the link is the exact template that fired; the `matched-at` URL; and the captured evidence, http/dns from the JSONL `request`/`response` and ssl/network from the stored file under `-srd`. In the response, re-run the template's own matcher (`words`/`regex`/`dsl`) to locate the indicator and mark it: ANSI-highlight the matched span in a terminal, caret-underline it when piped no-color, and name the pattern that fired.

Researcher needs to know exactly which templates were executed, and if some returned true positive, then the exact request/response or execution log and what indicator is bad.

## references

```

```

## references/browsing.md

# Browsing nuclei-templates efficiently

Two rules: filter by path before opening files, and prefer the indexes the repo already ships over walking ~10k YAML files.

## Directory map is the taxonomy

Path is signal before you open a file. Protocol is the top-level dir; under `http/` the subdir is the finding class.

| Path | Contents | Note |
|---|---|---|
| `http/cves/<year>/` | CVEs, foldered by year | year + freshness filtering |
| `http/vulnerabilities/` | non-CVE named bugs | overlaps CVEs, dedupe by `info.name` |
| `http/exposures/` | leaked configs, logs, backups, tokens | mostly single-GET, high replicable rate |
| `http/misconfiguration/` | insecure settings | benign, good default tier |
| `http/technologies/` | fingerprinting only | tier-0, no vuln claim |
| `http/exposed-panels/` | login interfaces | recon, pairs with default-logins |
| `http/default-logins/` | credential attempts | active-intrusive, gate it |
| `http/fuzzing/`, `dast/` | payload generation | never in a default run |
| `network/ ssl/ dns/` | non-HTTP protocols | different traffic profile |
| `file/` | matchers against local files | zero target traffic |
| `code/` | executes on scanner host | supply-chain risk, opt-in only |
| `headless/ javascript/` | browser / JS-protocol | heavier runtime deps |

## Use the shipped indexes first

Probe for these at repo root; fall back to a tree walk only if absent:

- `.nuclei-ignore` - canonical exclusion list. Read it, do not reinvent it.
- `cves.json` - CVE-to-template map, so a CVE query is a lookup.
- `TEMPLATES-STATS.json` - counts, for honest breadth reporting.
- `templates-checksum.txt` - detect which templates changed since last index.

## Fields that decide anything

```
info.severity                     # rank
info.tags                         # intent + intrusive families
info.metadata.product / vendor    # stack match, cleaner than tag guessing
info.metadata.max-request         # request count -> replicability
info.classification.cvss-score    # rank tiebreak
info.classification.epss-score    # real-world exploit likelihood, best first-run sort
requests[].payloads / attack      # combinatorics -> not replicable
unsafe: true                      # rawhttp -> not replicable, active
{{interactsh                      # OAST -> needs listener + permission
```

## Gotchas

- `workflows/` and `profiles/` reference templates by filter; not checks, skip them.
- `helpers/` is payloads and wordlists, skip.
- Dedupe `cves/` against `vulnerabilities/` on `info.name` + classification, not filename.
- `max-request > 1` means multi-request; do not assume one GET.
- Match both `.yaml` and `.yml`; do not follow tooling dirs or symlinks out of tree.

Order: path filter, confirm by `info.metadata`, tier by request contents, read an index instead of the tree whenever one exists.

## references/install.md

# Nuclei install reference

Nuclei distributes a single static binary and a git-cloned template library. There is no framework to vendor. Prefer a package manager; fall back to the API-resolve snippet. Never hardcode a version-stamped asset URL, it goes stale on the next release.

## Canonical sources

| What | URL |
|---|---|
| Binary releases | https://github.com/projectdiscovery/nuclei/releases |
| Source | https://github.com/projectdiscovery/nuclei |
| Templates | https://github.com/projectdiscovery/nuclei-templates |
| Docker image | docker pull projectdiscovery/nuclei |
| Docs | https://docs.projectdiscovery.io/tools/nuclei |

## Binary

Package managers resolve the version for you:

```bash
brew install nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
```

Release assets are version-stamped (e.g. `nuclei_3.4.10_linux_amd64.zip`), so resolve the latest from the API rather than guessing a filename:

```bash
OS=linux ARCH=amd64
URL=$(curl -s https://api.github.com/repos/projectdiscovery/nuclei/releases/latest \
  | grep -o "https://github.com/[^\"]*nuclei_[0-9.]*_${OS}_${ARCH}.zip")
curl -sL "$URL" -o nuclei.zip
curl -sL "$(dirname "$URL")/checksums.txt" -o checksums.txt
grep "$(basename "$URL")" checksums.txt | sha256sum -c -   # verify before unzip
unzip -o nuclei.zip nuclei
```

## Templates

```bash
git clone --depth 1 https://github.com/projectdiscovery/nuclei-templates
nuclei -update-templates   # if the binary exists; clones to ~/.local/nuclei-templates
```

## What this skill requires

- Templates clone: required for browsing and selection (no target traffic).
- Binary: required only to execute the emitted command.

Both are offers, not steps. Print the command; let the operator run it.