nuclint

A static linter for Nuclei templates — flags risky templates before you run them.

A modern Nuclei template can execute code, read environment variables, exhaust the scanner, or change the target's state. nuclint scans templates with regex signatures and surfaces those constructs so a human can review them. It warns, it does not block.

Categories

Category	Severity	Flags
SUSPICIOUS_PAYLOAD	medium	reading /etc/passwd, /etc/shadow, win.ini
HARDCODED_OAST	medium	hardcoded interact.sh / oast.* instead of {{interactsh-url}}
HARD_SCHEME_PORT	medium	hardcoded scheme/port instead of {{BaseURL}}
STATE_CHANGING_OPERATION	high	PUT/DELETE/PATCH, create/delete/reset endpoints
DESTRUCTIVE_SQL_FS	critical	DROP/DELETE FROM, rm -rf, service stop, /etc/passwd overwrite
EMBEDDED_CODE_BLOCK	high	exec/eval/subprocess/sh -c
EXTERNAL_PAYLOAD_HOSTING	high	curl/wget/Invoke-WebRequest to external URLs, pipe-to-shell
ENV_READ_USAGE	high	get_env/os.Getenv, ASM keys (SHODAN_KEY, FOFA, …)
LARGE_RES_EXHAUSTION	high	repeat()/md5()/sha*() with large constants (scanner DoS)

Run

Requires Python 3.8+ and PyYAML.

pip install pyyaml
python nuclint.py -d ./nuclei-templates -r nuclint.yaml -o report.json

Flag	Description
-d	directory to scan recursively
-r	rules file (nuclint.yaml)
-o	JSON report output (required to see findings)
-C	lines of context per match (default: 2)

License

© JSC CYBER OK. Use of this software is governed by the End User License Agreement in LICENSE (personal, non-commercial use only). See the file for full terms.