/report

name: report
description: "Generate a disclosure report from the current finding. Auto-detects the best submission channel. Usage: /report (run from target directory with confirmed finding)."

/report

Generate a professional disclosure report for a confirmed vulnerability finding.

Prerequisites

• Finding must be CONFIRMED by the Validator (verdict.md exists with CONFIRMED)
• PoC must be working (poc_*.py exits 0)
• CVSS score must be calculated

Process

Step 1: Gather Finding Details

Read from the target directory:

• `targets/<repo>/findings.md` for technical details
• `targets/<repo>/verdict.md` for confirmation
• `targets/<repo>/poc_<vuln_type>.py` for the PoC header
• `targets/<repo>/brief.md` for project info

Step 2: Determine Disclosure Channel

Check in priority order:

1. **HackerOne**: Search for the project

   curl -s "https://hackerone.com/directory/programs" | grep -i "<project>"

If found -> use HackerOne format

2. **GitHub Security Advisory**: Check if repo has advisories enabled

   gh api "repos/<owner>/<repo>" --jq '.has_security_policy // false'

If true -> use GHSA format

3. **SECURITY.md**: Check for security contact

   gh api "repos/<owner>/<repo>/contents/SECURITY.md" --jq '.content' | base64 -d 2>/dev/null

If exists -> use email format

4. **Package maintainer email**: Check package registry

   npm view <package> maintainers --json 2>/dev/null

If found -> use email format

5. **GitHub Issue**: Last resort

Step 3: Generate Report

GitHub Security Advisory Format

## Summary

[Vulnerability Type] in [package-name] [component] allows [impact description].

## Details

**Affected package**: [name]
**Affected versions**: [version range, e.g., "<= 3.2.1"]
**Patched version**: None (0-day)

### Root Cause

[Technical description of the vulnerability. Include the file path and line number.
Explain why the current code is vulnerable and what an attacker can do.]

### Attack Vector

[Step-by-step description of how an attacker would exploit this.]

1. [Step 1]
2. [Step 2]
3. [Step 3]

### Impact

[What an attacker can achieve. Be specific: read files, execute commands, etc.]

## Proof of Concept

[PoC code or steps to reproduce]

## Severity

**CVSS**: [vector string] = [score] [severity]
**CWE**: [CWE-XXX] ([name])

## Suggested Fix

[Specific recommendation for how to fix the vulnerability.
Include code examples if possible.]

## Timeline

- [Date]: Vulnerability discovered
- [Date]: Report submitted via [channel]
- [Date + 90 days]: Planned public disclosure (if no response)

HackerOne Format

## Summary

[One-line description]

## Vulnerability Type

[CWE-XXX]: [Name]

## Description

[Detailed technical description]

## Steps to Reproduce

1. Install [package]@[version]: `npm install [package]@[version]`
2. Create the following script: [PoC code]
3. Run: `python3 poc.py`
4. Observe: [expected output]

## Impact

[What an attacker can achieve and under what conditions]

## Supporting Material

- Tested on: [OS, Node.js/Python version]
- Package version: [exact version]
- CVSS: [score] [severity]

## Suggested Mitigation

[How to fix]

Email Format

Subject: [Security] [Severity] vulnerability in [Package] [Version]

Hi [maintainer name],

I've identified a [severity] [vulnerability type] vulnerability in
[package-name] version [version].

I'd like to report this through coordinated disclosure. Could you
confirm receipt of this message? I'll share the full technical details
and PoC once you acknowledge.

Brief summary: [1-2 sentences describing the issue without full exploit details]

Severity: [CVSS score and vector]
CWE: [CWE number and name]

I follow a 90-day coordinated disclosure timeline from acknowledgment.

Best regards,
[Your name]

Step 4: Present to Director

DISCLOSURE REPORT READY

Package: <name>@<version>
Vulnerability: <type>
Severity: <CVSS score and level>
Channel: <recommended channel>

Report preview:
<first 10 lines of the report>

Actions needed:
1. Review the full report at targets/<repo>/report.md
2. Approve submission to <channel>
3. I'll handle the submission on your approval

Approve?

Step 5: On Approval

Write the report to `targets/<repo>/report.md` and inform the Director it's ready to submit through the chosen channel.

Update REGISTRY.md to SUBMITTED status.