pentest-report

name	pentest-report
description	Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending to the client.
license	MIT
metadata	{"version":"1.0.0","author":"Rifteo","tags":["pentest","audit","report","deliverable","findings"]}

Pentest Report Generator

Turn all findings from a testing engagement into a single, client-ready penetration test report. Auditors spend 30-40% of engagement time on reporting. This skill handles the structure, ordering, and framing — you provide the findings.

What You Need Before Starting

• Confirmed findings (from finding-writer)
• Engagement scope and target (from ENGAGEMENT.md or scope-grill output)
• Test dates and tester names (ask if not available)

Report Structure

Generate each section in order. See references/report-template.md for the full template.

1. Cover Page

Client name, engagement title, date range, classification (Confidential), prepared by.

2. Executive Summary

3-5 paragraphs. Written for a non-technical audience (C-suite, board).

• What was tested and why
• Overall risk posture in plain language
• The single most critical finding, in business terms
• Top 3 recommended actions

Do not use technical jargon. Do not list every finding. See references/exec-summary-guide.md.

3. Scope and Methodology

• In-scope targets (from ENGAGEMENT.md)
• Out-of-scope items
• Test type (black/grey/white box)
• Test dates
• Tools and techniques used (high level)
• Limitations and caveats

4. Risk Summary Table

#	Title	Severity	Component	Status
F-01	SQL Injection in /api/search	Critical	API	Confirmed

Order by severity (Critical → High → Medium → Low → Info).

5. Technical Findings

One section per finding, in the same order as the risk table. Each finding uses the full finding-writer format: Title, Severity, CVSS, Description, Evidence, Impact, Recommendation, References.

6. Recommendations Summary

Ordered action list — immediate (Critical/High) first, then Medium, then hardening. Cross-reference finding IDs (F-01, F-02...).

7. Appendices (if applicable)

• Full tool output
• Scope confirmation letter reference
• Methodology references

Rules

• The executive summary must be understandable by someone with no security background
• Never include unconfirmed findings — mark suspected issues as "Out of Scope" or "Requires Further Testing"
• Every finding in the report must have a corresponding ID in the risk table
• Do not pad with generic security advice unrelated to the engagement
• Ask for test dates and tester name if ENGAGEMENT.md is missing