## TL;DR
An empty JSONL has two opposite meanings, the target is clean, or the scan never ran properly, and an agent that assumes the first turns outages into clean bills of health. Require positive proof of a real scan: the runner records templates loaded, requests made, and exit status; the report may claim no findings only when those prove a completed scan of the authorized target.

```text
agent reported "no vulnerabilities" after parsing an empty nuclei JSONL as clean
```

## Use this when
- The report says no vulnerabilities for a target, and the nuclei JSONL for that run is zero bytes or missing.
- Other targets in the same run produced normal output, making one empty file stand out.

## Not for this skill when
- The JSONL is empty but the nuclei log shows a completed run with templates executed and the target responding. That is a defensible clean result; file the log as its evidence.
- The target was excluded from scanning by the client. That is an exclusion to report, not a clean scan.

## Steps
1. Pull the run artefacts for the allegedly clean target: JSONL size, nuclei log, command used, and exit status. Verify: Verify: you can state whether a scan process actually ran and completed.
2. Check the target was reachable and in scope at scan time by requesting it now and comparing with any outage notes from the run window. Verify: Verify: reachability then and now is addressed, not assumed.
3. Re-run the nuclei scan for this authorized target with output and log captured to named files, at the engagement's agreed rate. Verify: Verify: the rerun produces a log showing templates loaded and requests sent, whatever the finding count.
4. Compare outcomes: if the rerun finds issues, the original claim was a failed scan; if it is also clean with full logs, the clean claim now has evidence. Verify: Verify: the report wording cites the rerun and its log, or the corrected findings.
5. Encode the rule in the pipeline: an empty or missing output file marks the target as scan-failed in the run manifest, and the report builder cannot render a clean claim for a scan-failed target. Verify: Verify: a test with an empty file blocks the clean wording and surfaces a failure note instead.

## Variant phrasings
### empty nuclei output interpreted as clean scan agent
The root-cause phrasing.
### no findings vs scan failed distinguish report
The distinction phrasing every report needs.
### require scan completion proof templates loaded requests sent
The evidence phrasing.

Compatibility: Compatibility: any agent pipeline running nuclei or other file-output scanners; completion proof should be captured by the runner wrapper.

## Why it happens
Absence of evidence is the default output of both a perfect scan and a dead one. Parsers see an empty file as an empty result set, and report writers turn an empty result set into the sentence clients most want to hear. The semantic jump from nothing in the file to nothing wrong with the target needs the runner's own testimony, which only exists if the wrapper records how the scan actually went.

## Edge cases / pitfalls
- Interruption, licence failure, and a mistyped target path all produce the same empty file; the wrapper log is what separates them at review time.
- A clean claim is a strong statement in a client report; hold it to a higher evidence bar than a finding, not a lower one.
- Apply the same rule to every scanner import, not just nuclei; Burp and ZAP exports fail empty in their own ways.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Om9Pw5t8I0Hvua3LE2cP-A