projectdiscovery/nuclei · error

could not marshal inline secrets: %w

Error message

could not marshal inline secrets: %w

What it means

yaml.Marshal of the extracted `secrets:` value failed (cmd/nuclei/main.go:894) while preparing the temporary secrets file. Because the section was decoded into interface{}, this only occurs when the data contains node shapes yaml.v3 cannot encode — typically complex mapping keys (sequences/mappings used as keys). The wrapped %w error names the exact marshal fault; it is rare.

Source

Thrown at cmd/nuclei/main.go:894

// Returns the path to the temp file or empty string if no secrets found.
func processInlineSecretsFromProfile(profilePath string, options *types.Options) (string, error) {
	data, err := os.ReadFile(profilePath)
	if err != nil {
		return "", fmt.Errorf("could not read profile file: %w", err)
	}

	var profile profileSecrets
	if err := yaml.Unmarshal(data, &profile); err != nil {
		return "", fmt.Errorf("could not parse profile YAML: %w", err)
	}

	if profile.Secrets == nil {
		return "", nil
	}

	secretsData, err := yaml.Marshal(profile.Secrets)
	if err != nil {
		return "", fmt.Errorf("could not marshal inline secrets: %w", err)
	}

	tempDir := filepath.Join(os.TempDir(), "nuclei-secrets")
	if err := os.MkdirAll(tempDir, 0700); err != nil {
		return "", fmt.Errorf("could not create temp directory: %w", err)
	}

	tempFile, err := os.CreateTemp(tempDir, "inline-secrets-*.yaml")
	if err != nil {
		return "", fmt.Errorf("could not create temp secrets file: %w", err)
	}
	defer func() {
		_ = tempFile.Close()
	}()

	if _, err := tempFile.Write(secretsData); err != nil {
		_ = tempFile.Close()
		_ = os.Remove(tempFile.Name())

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Simplify the secrets section to plain string-keyed maps and lists
2. Remove complex keys, merge keys (<<), and anchors from the secrets block
3. Move secrets to a standalone secrets file passed via the secrets-file option instead of inline in the profile

Example fix

# before
secrets:
  ? [aws, key]
  : value

# after
secrets:
  - id: aws_key
    value: value

secretsData, err := yaml.Marshal(profile.Secrets)
if err != nil {
    return fmt.Errorf("inline secrets use unsupported YAML shapes (complex keys?): %w", err)
}

When it happens

Trigger: A secrets section using complex keys (e.g. `? [a,b]: value`), merge keys/anchors producing exotic node types, or other structures the encoder refuses.

Common situations: Over-creative hand-written secrets YAML converted from JSON or other tooling; copy-paste of example configs with unusual key styles.

Related errors

• include directive preprocessing is disabled
• could not parse profile YAML: %w
• Invalid protocol type: {valueToMap}
• invalid workflow with no templates or tags
• prompt not found (read cap reached)

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/2d7e667e6a28c4ff. Report an issue: GitHub.