Proposed Changes

This PR addresses two practical profile usability gaps from #5567:

  1. Ignore profile metadata keys

    • Allows id, name, purpose, and description in template profile YAML without failing config merge.
    • These keys are stripped before passing data to goflags merge.
  2. Support inline list: values in profile YAML

    • If list contains multiline content, nuclei now materializes it to a temp file and uses it as TargetsFilePath.
    • This enables profile-local target lists without external host files.

Proof

go test ./cmd/nuclei -run 'TestSanitizeTemplateProfileForMerge|TestMaterializeInlineListTargets' -count=1
ok github.com/projectdiscovery/nuclei/v3/cmd/nuclei 0.737s

Checklist

  • PR created against dev
  • Tests added for the new behavior
  • Test command included
  • Docs update (can add after maintainer preference)

/claim #5567

Summary by CodeRabbit

New Features

  • Inline target lists can now be passed directly in commands as newline-separated values without requiring separate files

Bug Fixes

  • Configuration merging now properly excludes non-essential profile metadata to prevent merge conflicts

Tests

  • Added test coverage for profile sanitization and inline target list processing

Claim

Total prize pool $152
Total paid $0
Status Pending
Submitted February 21, 2026
Last updated February 21, 2026

Contributors

TY

tyeungchukong-gmail-com

@tyeungchukong-gmail-com

100%

Sponsors

PR

ProjectDiscovery

@projectdiscovery

$150
ST

starmovie12

@starmovie12

$2