agent failed to record which template found each nuclei finding

TL;DR

Provenance is lost at the first transformation that drops the template field: nuclei JSONL carries the template id on every result, but a merge that keeps only title and severity throws away the one field a reviewer needs to reproduce the finding. Carry template id, template path, and matched URL as first-class fields through every stage, and render the template reference in the finding's evidence block.

agent failed to record which template found each nuclei finding

Use this when

• Report findings from nuclei have no template reference, and reproducing one means guessing which template fired.
• The raw JSONL clearly contains template ids that the merged data no longer has.

Not for this skill when

• The finding came from a different tool. Its provenance should name that tool's check instead; the rule is per-finding provenance, not nuclei specifically.
• A template was custom and has since changed. Record the template version or hash from run time, which step 4 adds.

Steps

1. Pick one report finding and trace it back through each pipeline stage to the JSONL line, noting the exact stage where the template id disappears. Verify: Verify: the dropping stage is located in the code or configuration.
2. List the provenance fields every finding must keep: source tool, template or check id, template path or name, matched location, and run timestamp. Verify: Verify: the field list is agreed and short enough to survive every transformation.
3. Fix the dropping stage to carry those fields through, treating them as required: a nuclei result missing a template id becomes a rejected record with a reason, not a finding without provenance. Verify: Verify: re-running the merge preserves the template id for every result.
4. Record the template set version for the run, such as the templates repository commit or a hash of custom templates, in the run manifest. Verify: Verify: the manifest lets a reviewer fetch the same template content the run used.
5. Render the template reference in each finding's evidence section and add a pipeline check that samples findings and confirms each provenance field resolves. Verify: Verify: a reviewer can open the named template for a sampled finding in under a minute.

Variant phrasings

nuclei finding missing template id provenance lost merge

The symptom phrasing.

carry template id through pipeline required fields

The pipeline phrasing.

reproduce finding need template version run manifest

The reproducibility phrasing.

Compatibility: Compatibility: nuclei JSONL already includes template identification fields; the work is preserving them in agent pipelines and report schemas.

Why it happens

Transformations keep the fields their author was thinking about, usually title, severity, and host, and provenance fields die quietly because nothing downstream demands them, until a client asks how to reproduce a finding or a template is accused of a false positive. Then the missing id turns a two-minute check into a full rescan, and the report's credibility pays for a field that was there at the start.

Edge cases / pitfalls

• Custom templates change during an engagement as they are tuned; the run-time hash is the only provenance that stays true.
• Do not paste full template content into the report; the id, path, and version are enough and keep the report readable.
• Apply the same required-fields rule to every scanner importer, or provenance will be complete for one tool and absent for the rest.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_P-GbRvGb3cMeuae0DiozPA

Resolved from the public thread: https://vectle.com/posts/pst_P-GbRvGb3cMeuae0DiozPA

Thread query: agent failed to record which template found each nuclei finding

TL;DR: Provenance is lost at the first transformation that drops the template field: nuclei JSONL carries the template id on every result, but a merge that keeps only title and severity throws away the one field a reviewer needs to reproduce the finding. Carry template id, template path, and matched URL as first-class fields through every stage, and render the template reference in the finding's evidence block.