/reporting

name: reporting
description: |
  This skill should be used when the user mentions "generate report", "pentest report",
  "engagement report", "findings report", "executive summary", "technical report",
  "vulnerability report", "remediation report", "remediation plan", "retest report",
  "write up findings", "document findings", "report findings", "create report",
  "final report", "assessment report", "security report", "audit report",
  "CVSS score", "CVSS vector", "risk rating", "risk assessment", "severity rating",
  "finding writeup", "finding documentation", "proof of concept", "PoC documentation",
  "evidence documentation", "screenshot evidence", "report template",
  "report structure", "report format", "deliverable", "client deliverable",
  "remediation guidance", "fix recommendations", "remediation priority",
  "retest validation", "retest verification", "regression testing",
  "OWASP report", "PTES report", "compliance report", "PCI report",
  "attack narrative", "exploitation timeline", "testing coverage",
  "exploit chain documentation", "chain of evidence", "finding prioritization",
  or discusses creating, structuring, writing, or delivering penetration testing documentation
  and assessment reports. Activate even when the user says "write up the results",
  "summarize findings", or "document what we found" in an engagement context.
version: 2.0.0

Security Reporting

End-to-end pentest reporting for web and application security engagements -- from data gathering through structured report generation. This skill integrates deeply with elliot's data layer to produce comprehensive, evidence-backed deliverables aligned with OWASP Testing Guide and PTES reporting standards.

Why This Matters

The report is the only artifact the client keeps. Every vulnerability discovered, every technique attempted, every chain identified -- it all means nothing if the report is unclear, incomplete, or poorly structured. A good report drives remediation. A bad report gets filed and forgotten.

Report Lifecycle

Data Gathering --> Finding Prioritization --> Report Structure --> Writing --> Quality Review --> Delivery

Every phase draws on elliot's data layer. Skip nothing.

Phase 1 -- Data Gathering

Before writing a single line, collect all engagement data from elliot's trackers.

Vulnerability Data

# Full findings summary -- severity counts, status breakdown
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" summary

# All findings with details
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" list

# Search for specific finding types
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" search sqli
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" list --severity CRITICAL
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" list --type xss

# Export findings as formatted HTML
node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" html

Testing Coverage

# Technique coverage summary -- tools used, results, gaps
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" summary

# Full coverage analysis -- what was tested, what was not
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" coverage

# All tool reports generated during the engagement
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" reports

# Export techniques as formatted HTML
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" html

# Search for specific technique results
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" list --result success
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" list --result blocked

Exploit Chains

# Detect exploit chains from combined findings
node "${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js"

# Check if a specific finding participates in chains
node "${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js" check f-001

# View chain rule glossary
node "${CLAUDE_PLUGIN_ROOT}/scripts/chain-detector.js" glossary

Chain detection uses 11 built-in rules that match finding combinations (e.g., SSRF + cloud metadata = cloud credential theft, SQLi + file read = source code disclosure). Chains elevate the severity of their component findings and MUST be documented in the report.

Campaign Metadata

# Campaign state -- phases, steps, progress, blockers
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

# Current scan profile (loud/normal/stealth/paranoid)
node "${CLAUDE_PLUGIN_ROOT}/scripts/scan-profile.js" show

Target Context

# Target intelligence gathered during the engagement
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" summary

# All intel for a specific target
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" show example.com

# Intel by category
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" list --category tech-stack
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" list --category defense
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" list --category credential

Hexstrike Report Tools

Load: `ToolSearch` -> `select:mcp__hexstrike-ai__create_vulnerability_report`

Use `create_vulnerability_report` for formatted individual vulnerability documentation via Hexstrike.

Load: `ToolSearch` -> `select:mcp__hexstrike-ai__create_scan_summary`

Use `create_scan_summary` to consolidate multiple tool runs into a unified summary.

Load: `ToolSearch` -> `select:mcp__hexstrike-ai__format_tool_output_visual`

Use `format_tool_output_visual` to format raw tool output for inclusion in reports.

Phase 2 -- Finding Prioritization

After gathering data, prioritize findings for the report. This determines report structure and emphasis.

Severity Classification

Use CVSS 3.1 base scores for technical precision. Map to qualitative ratings:

| Severity | CVSS Range | Characteristics | Report Priority | |----------|-----------|-----------------|-----------------| | Critical | 9.0 - 10.0 | RCE, full DB acces