/pentest-report

name: pentest-report
description: >-
  Assemble a complete penetration test / security assessment report from a set
  of findings and engagement scope. Use at the end of an engagement to produce
  the deliverable document. Composes individual findings and an executive summary.

Goal

A client-ready assessment report with a consistent structure, an executive summary leadership can read, and detailed findings engineers can act on.

Report structure

1. **Cover & metadata** — client, engagement type, dates, testers, version, classification/handling label. 2. **Executive summary** — see `/security-reporting:executive-summary`; risk posture in business terms, headline findings, overall rating. 3. **Scope & methodology** — what was in/out of scope, rules of engagement, testing window, methodology/standards followed (PTES, OWASP WSTG, OSSTMM, NIST 800-115), the severity-scoring standard (CVSS v4.0), and limitations/caveats. 4. **Findings summary** — table: ID · Title · Severity · CVSS 4.0 score · Status, plus a severity-count chart (defer the chart to `security-diagramming:infographic`). 5. **Detailed findings** — each via `/security-reporting:finding`, ordered by severity. 6. **Remediation roadmap** — prioritized, with suggested timelines/owners. 7. **Appendices** — tooling, raw output refs, retest results, glossary.

Steps

1. Collect all findings and confirm each is CVSS 4.0-scored (via `/security-reporting:cvss`, not hand-computed) and deduplicated. 2. Derive the overall risk rating from the finding distribution + business context. 3. Generate the executive summary and the findings table. 4. Embed diagrams (attack trees / architecture) from `security-diagramming`. 5. Output as Markdown (and offer HTML/PDF). If integrations are configured, offer to publish to Confluence or attach to a Jira epic.

Output

The full report document, plus a separate one-page executive summary and a findings CSV/table suitable for tracking.

Notes

Keep the executive summary jargon-free; keep detailed findings precise and evidence-backed. Never include live credentials or unredacted PII in the report. Severity throughout the report is CVSS v4.0 — if any finding was scored before this plugin's CVSS 4.0 rewrite, re-score it rather than mixing 3.1 and 4.0 numbers in the same findings table.