Individual skill
composing-vulnerability-report
Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding sections (title, severity, target, detail, remediation, evidence) and a top-level summary table. The canonical written artifact a customer receives at engagement close; precise, reproducible, machine- checkable against source findings. Use when: closing an engagement, generating an interim report, regenerating after CVE or OWASP enrichment, or producing the input for generating-executive-summary. Threshold: findings missing required fields are dropped. HIGH and CRITICAL findings highlighted in the summary section. Trigger with: "compose vuln report", "write pentest report", "generate vulnerability deliverable", "render findings to report".
plugins/security/penetration-tester/skills/composing-vulnerability-report/SKILL.md
Source commit 0500b275e963c027f6b410e8c49c0446945c574e
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 12, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 2,916
- Repository last updated
- Nov 12, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai Repository topic
- automation Repository topic
- claude-code Repository topic
- devops Repository topic
- mcp Repository topic
- ai-agents Repository topic
- anthropic Repository topic
- claude-code-plugins Repository topic
- developer-tools Repository topic
- llm Repository topic
- security Declared skill tag
- reporting Declared skill tag
- vulnerability-report Declared skill tag
- cvss Declared skill tag
- pentest Declared skill tag
- security Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesSKILL.mdcore · 7,781 bytesreferences/PLAYBOOK.mddoc · 6,883 bytesreferences/THEORY.mddoc · 7,106 bytesscripts/compose_report.pyruns · 13,350 bytes
Read excerpt
# Composing Vulnerability Report
## Overview
After cluster 1-4 scan skills run, each one produces a Findings
file. A typical engagement ends up with eight to twenty such files
across the different skill categories. The customer wants ONE
vulnerability report — comprehensive, deduplicated, organized by
severity, with each finding cross-referenced to its source skill
and target.
This skill consumes one or more findings files (JSONL preferred,
JSON list also accepted), deduplicates entries by the canonical
fingerprint defined in `lib/finding.py`, enriches each finding