gizmoduck

Run Nuclei vulnerability scans, generate triaged reports, and file ServiceDesk Plus tickets for findings.

2|Updated Jul 28, 2026
One-click install
npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill gizmoduck-mbadali25
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: gizmoduck
Source: https://github.com/mbadali25/useful-claude-add-ons/tree/main/plugin/gizmoduck/skills/gizmoduck
Command: npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill gizmoduck-mbadali25

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires nuclei, wkhtmltopdf, and includes scripts (resource) components.

What problem does it solve? Running a vulnerability scan is only half the job — the findings still need to be deduplicated, triaged by severity, turned into a readable report, and tracked as tickets. This Skill automates that entire pipeline from Nuclei scan to ServiceDesk Plus ticket creation with a single batch confirmation. ## Core Features & Use Cases - End-to-end scanning: Runs Nuclei against URLs, hosts, IPs, or target-list files, filtered to critical/high/medium severities, and outputs JSONL findings. - Triaged reporting: Generates Markdown, HTML, or PDF reports that itemize Critical/High/Medium findings, dedupe across targets by template ID, and number findings in remediation order. - Gated ticketing: Previews a batch of ServiceDesk Plus tickets (create vs. add-note split based on existing open requests) and only files them after one explicit approval bound to a digest of the exact batch. - Use Case: After deploying a new site, scan it for known vulnerabilities, review a severity-ordered PDF report, then open tickets for all High and Critical findings in one confirmed batch. ## Quick Start Scan https://my-new-site.example.com with Nuclei for critical, high, and medium findings, then give me a report and file tickets for the serious ones.

Frequently Asked Questions about gizmoduck

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a Nuclei vulnerability scan against a website?

Run the scan command with a URL, host, IP, or a targets file, filtering by severity such as critical,high,medium. The output is written as JSONL findings, which can then be summarized, reported, or turned into tickets.

How do I create ServiceDesk Plus tickets from Nuclei findings?

Run the tickets command without --yes first to get a preview batch and digest, confirm the batch with the user, then rerun the exact printed command with --yes and the digest. Each finding maps to a stable [Nuclei template-id] subject, creating new requests or adding notes to existing open ones.

Does Nuclei scanning work on Windows and WSL?

Yes, the workflow runs on Linux, WSL, and Windows. On Linux call the CLI with python3 and on Windows use python; bootstrap scripts are provided for each platform if Nuclei is not yet installed.

Why are Low and Info findings missing from the Nuclei report?

Reports itemize only Critical, High, and Medium findings because Low and Info output is inventory noise like version banners and DNS records. They are still counted in the severity table, and the report states how many were suppressed.

What are the limitations of Nuclei for vulnerability scanning?

Nuclei is a template-based known-issue scanner, not a crawler-driven DAST, so it only finds what a template exists for. For custom application-logic flaws like auth journeys or business logic, a tool like OWASP ZAP is the appropriate complement.