/opsec-reporting

name: opsec-reporting
description: |
  This skill should be used when the user mentions "generate report", "opsec report",
  "engagement report", "pentest report", "red team report", "purple team report",
  "security assessment", "hardening report", "compliance report", "audit report",
  "findings report", "evidence handling", "chain of custody", "redaction", "redact",
  "report delivery", "secure delivery", "debrief", "debrief prep", "post-engagement",
  "artifact inventory", "secure destruction", "evidence capture", "screenshot capture",
  "metadata removal", "report encryption", "encrypted report", "GPG report",
  "compliance reporting", "PCI-DSS report", "SOC2 report", "HIPAA report",
  "CVSS scoring", "DREAD scoring", "severity classification", "finding severity",
  "operational timeline", "timeline documentation", "operation log", "activity log",
  "cleanup report", "trace elimination report", "VPS audit report", "dead drop",
  "secure channel", "report template", "executive summary", or discusses generating
  documentation about operational security posture, engagement results, or red team activities.
  Use this skill even when the user just says "write up the results" or "document what we did"
  in an engagement context.
version: 2.0.0

Opsec Reporting

End-to-end operational reporting for red team engagements — from evidence capture through secure delivery and post-engagement destruction. Every report produced through this skill is designed to protect both the operator and the client by enforcing metadata hygiene, redaction discipline, and secure handling throughout the report lifecycle.

Why This Matters

Reports are the most dangerous artifact an operator produces. They contain target details, exploitation paths, credentials, and internal architecture — all in a single document. A report leaked, intercepted, or left unencrypted on disk is an operational compromise. This skill treats reports as sensitive material from creation to destruction.

Report Lifecycle

Evidence Capture → Classification → Drafting → Redaction → Encryption → Delivery → Destruction

Every phase is documented. Every phase has opsec controls. Skip nothing.

Report Types

| Report Type | When to Use | Template | Reference | |-------------|-------------|----------|-----------| | Engagement Summary | End of any engagement | Executive + technical sections | `references/report-templates.md` | | Hardening Assessment | After system hardening audit | Coverage map + findings matrix | `references/report-templates.md` | | Trace Elimination | After cleanup operations | Artifact inventory + verification | `references/report-templates.md` | | VPS Security Audit | After VPS provisioning/audit | Provisioning checklist + exposure map | `references/report-templates.md` | | Purple Team Exercise | Joint red/blue engagement | Attack timeline + detection gaps | `references/report-templates.md` | | Compliance Assessment | PCI-DSS, SOC2, HIPAA mapping | Control mapping + gap analysis | `references/compliance-reporting.md` | | Debrief Package | Pre-presentation preparation | Slide-ready findings + demo notes | `references/debrief-and-delivery.md` | | Incident Timeline | Documenting operational chronology | Timestamped event sequence | `references/report-templates.md` |

Data Collection

Before writing any report, gather all available data from trenton's data layer:

# Operational data
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" coverage
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" list

# Identity rotation history
node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" list

# Current opsec profile
node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" show

# Session state and metrics
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

Evidence Handling

Read `references/evidence-handling.md` for full evidence handling procedures, including:

• Screenshot capture with automatic metadata stripping
• Chain of custody documentation
• Evidence hashing (SHA256) for integrity verification
• Secure evidence storage with encryption at rest
• Evidence correlation and cross-referencing

All evidence must be hashed on capture and logged to the ops tracker:

# Log evidence capture
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "evidence-capture" \
  --detail "Screenshot of <target>:<port> — SHA256:<hash>"

Redaction

Read `references/redaction-methodology.md` for redaction rules by opsec profile. Key principles:

• **Always redact**: Real credentials, API keys, tokens, session cookies
• **Profile-dependent**: IP addresses, hostnames, domain names, employee names
• **Never redact**: Finding descriptions, severity ratings, remediation steps

Redaction markers use consistent format: `[REDACTED-<TYPE>-<SEQ>]` (e.g., `[REDACTED-IP-001]`, `[REDACTED-CRED-003]`). A redaction key mapping markers to real values is stored separately, encrypted, and delivered only to authorized recipients.

Severity Classification

Findings use dual classification — CVSS 3.1 base score for technical precision, DREAD for business context:

| Severity | CVSS Range | DREAD Range | Report Color | |----------|-----------|-------------|--------------| | Critical | 9.0 - 10.0 | 40 - 50 | Red | | High | 7.0 - 8.9 | 30 - 39 | Orange | | Medium | 4.0 - 6.9 | 20 - 29 | Yellow | | Low | 0.1 - 3.9 | 10 - 19 | Blue | | Informational | 0.0 | 0 - 9 | Gray |

See `references/compliance-reporting.md` for CVSS vector string construction and DREAD scoring methodology.

Opsec Profile Integration

Report handling adapts to the active opsec profile:

| Aspect | `loud` | `normal` | `stealth` | `paranoid` | |--------|--------|----------|-----------|------------| | Report format | Markdown on disk | Markdown on disk | Encrypted Markdown | Me