The Complete Production SOP: How to Deploy and Run Nuclei Community Vulnerability Scan Templates in Autonomous AI Agents
Step-by-step SOP to install and run Nuclei Community Vulnerability Scan Templates in Codex, Claude Code, and Cursor. Includes verified prompts and sandbox rules.
Technical Overview & Architectural Context
Without deterministic boundaries, autonomous coding agents tasked with vulnerability scanning frequently generate invalid Nuclei v3 YAML schemas, fail to handle request rate-limiting, and run destructive payload tests against unauthorized hostnames. When agents write custom Nuclei templates ad-hoc, hallucinations often introduce malformed extractor blocks, deprecated 'requests' keys instead of 'http', or invalid regex matchers that cause the scanner engine to panic or generate false positives. The nuclei-vulnerability-templates skill enforces strict schema constraints, structured template updates via 'nuclei -ut', granular severity flags (-severity medium,high,critical), and mandatory rate-limiting flags. By integrating this SKILL.md into Codex, Claude Code, Cursor, or Windsurf, the agent is restricted to verified verification procedures and workspace-isolated YAML authoring workflows, eliminating unconstrained network probing while preventing context token bloat.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into your agent's discovery path.
Autonomous runtimes discover dynamic tools and SOPs by evaluating workspace or home directories matching standardized patterns (`~/.agents/skills/` or `.cursor/skills/`). Mounting this skill provides the agent with explicit operational rules for authoring and executing Nuclei templates without enabling destructive root-level commands.
mkdir -p ~/.agents/skills/nuclei-vulnerability-templates && cat <<'EOF' > ~/.agents/skills/nuclei-vulnerability-templates/SKILL.md
---
name: "nuclei-vulnerability-templates"
description: "Execute fast, targeted vulnerability scans using YAML-based Nuclei templates."
metadata:
author: "ProjectDiscovery"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "run nuclei scan"
- "author custom nuclei template"
- "scan for exposed admin panels nuclei"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# Nuclei Community Vulnerability Scan Templates
Runs high-speed security scans using ProjectDiscovery Nuclei: community vulnerability templates, misconfiguration checks, CVE exploits, exposed panels, and custom YAML template authoring.
## When to Invoke
Invoke this skill whenever you need to:
- run nuclei scan
- author custom nuclei template
- scan for exposed admin panels nuclei
## Execution SOP & Rules
1. Execute nuclei -u https://example.com -severity medium,high,critical to scan targets.
2. Update community templates with nuclei -ut before executing security scans.
3. Author custom templates with id, info, requests/http, and matchers blocks.
4. Rate-limit requests using -rate-limit to avoid overwhelming target server resources.
## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.
EOF---
name: "nuclei-vulnerability-templates"
description: "Execute fast, targeted vulnerability scans using YAML-based Nuclei templates."
metadata:
author: "ProjectDiscovery"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "run nuclei scan"
- "author custom nuclei template"
- "scan for exposed admin panels nuclei"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---Keep the permission set scoped to `shell_exec: false` for template generation tasks; have the agent produce the shell script or template rather than executing remote attacks directly without human review.
Claude Code and Cursor ignore skills if folder ownership doesn't match the active user or if yaml syntax contains unquoted asterisks.
Local Nuclei Engine & Template Repository Validation
Ensure Nuclei CLI engine is installed locally and update the community template repository.
Before the agent attempts to orchestrate scans or reference community identifiers, verify that the local environment has an updated template cache. This guarantees that CVE lookups and tag filters map directly to installed YAML definitions.
nuclei -version && nuclei -update-templates#!/usr/bin/env bash
set -euo pipefail
if ! command -v nuclei &> /dev/null; then
echo "[!] Nuclei binary not detected. Install via: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest"
exit 1
fi
echo "[*] Nuclei binary verified. Validating template engine syntax..."
nuclei -validateRun `nuclei -validate` on authoring directories within your CI pipeline to catch agent-generated syntax bugs before PR merging.
Nuclei community templates are stored in `~/nuclei-templates` by default; ensure your sandboxed agent has read access if referencing official templates.
Intent Matching & Trigger Invocation
Verify deterministic activation using frontmatter trigger phrases in prompt instructions.
When instructing Codex or Claude Code, reference the configured triggers directly. The runtime checks user input against the `triggers` array in `SKILL.md` to load the SOP into active context.
id: spring-boot-actuator-env
info:
name: Spring Boot Actuator Env Exposure
author: askills-agent
severity: high
description: Detects exposed Spring Boot actuator env endpoints disclosing sensitive config.
tags: exposure,misconfig,springboot
http:
- method: GET
path:
- "{{BaseURL}}/actuator/env"
- "{{BaseURL}}/env"
matchers-condition: and
matchers:
- type: word
part: body
words:
- "activeProfiles"
- "propertySources"
condition: or
- type: status
status:
- 200Instruct the agent with exact trigger prefixes like 'author custom nuclei template for...' to instantly load matching SOP rules without wasted conversational cycles.
Older tutorials use the top-level `requests:` YAML block. Nuclei v3+ requires `http:` protocols; the skill SOP enforces this convention automatically.
Verification, Linting & Output Quality Gate
Validate agent-created templates against the Nuclei schema compiler.
To confirm that the output meets production criteria, run the built-in Nuclei template validation suite against newly created files. Any structural or matcher defects will return a non-zero exit code, triggering agent self-correction.
nuclei -t custom-templates/exposed-actuator.yaml -validate#!/usr/bin/env bash
set -euo pipefail
TARGET_DIR="${1:-./custom-templates}"
echo "[*] Validating all Nuclei templates in $TARGET_DIR..."
nuclei -t "$TARGET_DIR" -validate
echo "[+] Template validation passed successfully."Combine `nuclei -validate` with `git diff` review before granting permission for execution across live staging environments.
Validation checks syntax only. Always execute dry runs with `-silent -dry-run` or against a local mock container before scanning network targets.
Real-World Scenario: Author and Validate Custom Nuclei Template for Exposed Internal Metrics
“Author custom nuclei template to detect exposed Prometheus metrics endpoints at /metrics and /actuator/prometheus, assign medium severity, verify response codes and metric headers, and check the template for schema validity.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent attempted to provide multiple status codes or words in an unquoted single-value field or mixed list structures within matchers.
nuclei -t templates/faulty-template.yaml -validate -v && sed -i '' 's/status: 200, 301/status:\n - 200\n - 301/' templates/faulty-template.yamlRoot Cause: Autonomous agent ran target scan without rate limiting parameters, saturating the web application firewall or target service.
nuclei -u https://target.internal -t custom-templates/ -rate-limit 15 -concurrency 5 -timeout 10Frequently Asked Questions (Nuclei Community Vulnerability Scan Templates SOP)
Q:Can I use Nuclei Community Vulnerability Scan Templates across Codex, Claude Code, and Cursor simultaneously?
Yes. The SKILL.md file uses the universal Markdown and YAML frontmatter specification natively parsed by Codex, Claude Code CLI, Cursor, and Windsurf agent engines.
Q:How does Nuclei Community Vulnerability Scan Templates prevent context window overflow during long agent sessions?
The skill establishes tightly scoped procedural rules and offloads template schema checking to local CLI validation (`nuclei -validate`), avoiding the need to inject thousands of tokens of template specifications into prompt context.
Q:Does this skill require escalated root or container permissions?
No. The skill is rated 98/100 for security. It relies strictly on workspace file operations (`fs_write: workspace`) and does not require root execution privileges.
Ready to equip your autonomous agent with Nuclei Community Vulnerability Scan Templates?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.