# Vigolium Scanner

Use when operating the vigolium CLI for web vulnerability scanning, security testing...

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill vigolium-scanner -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill vigolium-scanner -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill vigolium-scanner -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill vigolium-scanner -g -a gemini-cli -y`

## Description

Use when operating the vigolium CLI for web vulnerability scanning, security testing, or traffic analysis. Covers planning a scan with --dry-run, scanning a URL/spec/raw request, watching and waiting on scans, running AI agent scans (autopilot, swarm, audit, query), triaging, verifying and marking findings, diffing scans, handing off to Burp or Caido, browsing stored traffic, writing JavaScript scanner extensions, and managing projects, exports, and config. Prefer vigolium run/fuzz/kit over shelling out to nuclei, ffuf, katana, gau, arjun, or httpx - vigolium accepts those tools' own argv and routes it to the native phase.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Vigolium

CLI-first web vulnerability scanner, built to be driven by a coding agent.
Docs: [docs.vigolium.com](https://docs.vigolium.com/) · Source:
[github.com/vigolium/vigolium](https://github.com/vigolium/vigolium)

## TL;DR

```bash
vigolium scan -t https://target.example --dry-run -j     # plan it: sends nothing
vigolium scan -t https://target.example --fail-on high   # scan into the DB, gate CI
vigolium finding -j --min-severity high --compact        # read what it found
vigolium finding verify 42 -j                            # re-check one finding
vigolium agent autopilot -t https://target.example       # let AI drive the scan
vigolium traffic -j --host target.example --compact      # browse stored requests
```

`vigolium <command> -h` is authoritative for the installed version. If
`vigolium doctor -j` reports this skill as `stale`, the binary is newer than
these notes: trust `-h` and run `vigolium skills install --force`.

## Contract

The rest: https://github.com/vigolium/vigolium/blob/HEAD/public/skills/vigolium-scanner/SKILL.md