Nuclei — agentic threat model

Not certain from the listing — the underlying LLM is not specified, but it is highly vulnerable to prompt injection attacks that could trick the model into scanning unauthorized targets or executing malicious YAML templates.

Not certain from the listing — however, the agent retrieves and processes raw scan results, vulnerability reports, and community templates, presenting risks of result-injection or malicious template ingestion.

The MCP wrapper exposes powerful scanning, template management, and result retrieval tools. Insecure tool integration could allow an attacker to bypass target scope restrictions or execute arbitrary code via the 'code' protocol support in Nuclei.

Not certain from the listing — the deployment environment requires strict network sandboxing and egress filtering to prevent the agent from being used to scan internal networks (SSRF) or launch distributed denial-of-service (DDoS) attacks.

Not certain from the listing — there is no mention of built-in guardrails, logging of executed scan targets, or evaluation mechanisms to detect when the agent is being misused for unauthorized reconnaissance.

Not certain from the listing — the tool lacks native authorization policies, target whitelisting, or rate-limiting controls, which must be implemented externally to prevent regulatory and legal violations associated with unauthorized scanning.

In a multi-agent setup, other compromised or rogue agents could abuse the Nuclei agent to perform network reconnaissance, exploit discovered vulnerabilities, or exfiltrate sensitive network topology data.