Run any Skill in Manus with one click

red-team-report

Stars3

Forks1

UpdatedJune 25, 2026 at 18:14

Generate professional penetration testing and red team engagement reports from structured findings data. Use this skill whenever the user mentions pentest report, red team report, security assessment report, vulnerability report, executive summary for pentest, technical findings report, remediation report, compliance report, security audit deliverable, engagement report, final deliverable, or "write up the findings". Also trigger for: report template, finding write-up, risk matrix, CVSS summary table, attack narrative, attack chain documentation, remediation roadmap, re-test recommendations, or any request to produce a written deliverable from security testing data. This is the final phase of a pentest engagement — trigger after post-exploit completes, or standalone when the operator has findings data and needs a formatted report. Can produce Word (.docx), PDF, Markdown, or HTML report formats.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

az0307

az0307/Aurora-AI-Agency

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	red-team-report
description	Generate professional penetration testing and red team engagement reports from structured findings data. Use this skill whenever the user mentions pentest report, red team report, security assessment report, vulnerability report, executive summary for pentest, technical findings report, remediation report, compliance report, security audit deliverable, engagement report, final deliverable, or "write up the findings". Also trigger for: report template, finding write-up, risk matrix, CVSS summary table, attack narrative, attack chain documentation, remediation roadmap, re-test recommendations, or any request to produce a written deliverable from security testing data. This is the final phase of a pentest engagement — trigger after post-exploit completes, or standalone when the operator has findings data and needs a formatted report. Can produce Word (.docx), PDF, Markdown, or HTML report formats.
compatibility	{"tools":["bash","python"],"mcps":["hexstrike"],"skills":["recon-osint","vuln-analysis","exploit-dev","post-exploit","ai-agent-orchestration","docx","pdf"]}

RedTeamReport Skill

Overview

Generates professional penetration testing reports from structured engagement data. Produces both executive summaries (for leadership) and technical details (for remediation teams). Includes risk matrices, attack path narratives, finding write-ups with evidence, and prioritized remediation roadmaps.

Prerequisites

Engagement data from one or more prior phases (recon, vuln, exploit, post-exploit)
Engagement metadata: client name, scope, dates, methodology, tester names
For .docx output: use the docx skill (read its SKILL.md first)
For .pdf output: use the pdf skill (read its SKILL.md first)

Core Instructions

Step 1 — Collect All Engagement Data

Ingest structured output from prior skills:

/tmp/pentest/{target}/recon_output.json
/tmp/pentest/{target}/vuln_output.json
/tmp/pentest/{target}/exploit_output.json
/tmp/pentest/{target}/post_exploit_output.json
/tmp/pentest/{target}/exploitation_log.txt

If data is incomplete, work with what's available. Flag missing sections.

Step 2 — Report Structure

Generate the report with this standard structure:

1.  Cover Page
    - Report title, client name, engagement dates
    - Classification: CONFIDENTIAL
    - Assessor: {tester_name} / {company}

2.  Executive Summary (1-2 pages)
    - Engagement overview (scope, methodology, dates)
    - Overall risk rating (Critical / High / Medium / Low)
    - Key findings summary (top 3-5 findings in business language)
    - Strategic recommendations (3-5 bullet points)
    - Attack path narrative (non-technical story of the compromise)

3.  Methodology
    - Testing approach (PTES / OWASP / NIST / MITRE ATT&CK)
    - Tools used (from engagement data)
    - Scope and limitations
    - Rules of engagement summary

4.  Risk Summary
    - Finding severity distribution (table + chart data)
    - Risk matrix (likelihood × impact)
    - CVSS score distribution

5.  Detailed Findings
    For each finding (sorted by severity):
    ┌─────────────────────────────────────┐
    │ Finding ID: VULN-001                │
    │ Title: Remote Code Execution in...  │
    │ Severity: Critical (CVSS 9.8)      │
    │ CVE: CVE-2024-XXXXX                │
    │ Affected Asset: blog.example.com    │
    │                                     │
    │ Description:                        │
    │ [Technical explanation]             │
    │                                     │
    │ Impact:                             │
    │ [Business impact in plain English]  │
    │                                     │
    │ Evidence:                           │
    │ [Screenshots, command output]       │
    │                                     │
    │ Remediation:                        │
    │ [Specific fix steps]               │
    │                                     │
    │ References:                         │
    │ [CVE link, vendor advisory, CWE]   │
    └─────────────────────────────────────┘

6.  Attack Path Narrative
    - Step-by-step story of the full attack chain
    - Visual: attack flow diagram (Mermaid or text-based)
    - Timeline of exploitation activities

7.  Remediation Roadmap
    - Immediate (0-7 days): Critical findings
    - Short-term (1-4 weeks): High findings
    - Medium-term (1-3 months): Medium findings
    - Long-term (3-6 months): Hardening and architecture

8.  Appendices
    - A: Full tool output references (file paths)
    - B: Scope documentation
    - C: Methodology details
    - D: Re-test recommendations and timeline

Step 3 — Executive Summary Writing Guidelines

The executive summary is the most-read section. Write it for a non-technical audience:

Lead with business impact, not technical details
Use risk language: "An attacker could access customer payment data"
Quantify where possible: "3 of 5 web applications had critical vulnerabilities"
Include the attack narrative as a story: "Starting from the public internet, the assessor was able to gain administrative access to the customer database within 4 hours, demonstrating that a motivated attacker could achieve the same"
End with clear, actionable strategic recommendations

Step 4 — Finding Write-Up Quality Standards

Each finding must include:

Reproducible steps — another tester can verify
Evidence — output, screenshots, or logs (reference file paths)
Business context — why this matters beyond the CVSS score
Specific remediation — not just "patch it" but exact versions/configs
CWE mapping — Common Weakness Enumeration reference
MITRE ATT&CK mapping — technique IDs where applicable

Step 5 — Output Generation

For Markdown (.md) — fastest, use for drafts: Generate directly as structured Markdown.

For Word (.docx) — client deliverable: Load the docx skill SKILL.md, then generate using python-docx:

Professional formatting with heading styles
Table of contents
Finding severity color coding
Page numbers and headers
Cover page with client branding placeholder

For PDF — final sealed deliverable: Load the pdf skill SKILL.md, then generate from the .docx or directly.

For HTML — interactive version: Generate as single-page HTML with:

Collapsible finding sections
Severity filter controls
Attack path diagram (Mermaid.js)

HexStrike MCP Integration

Tool: generate_report
Args: {
  "findings": [{finding_objects}],
  "target": "example.com",
  "scope": "External network penetration test"
}
Returns: { report_markdown: "...", report_path: "/tmp/pentest/.../report.md" }

Uses GLM-4.5 on HexStrike for initial draft generation, then Sonnet for editorial review and executive summary refinement.

Attack Path Diagram Template

Generate with Mermaid syntax:

graph LR
    A["Internet"] -->|"RCE CVE-2024-XXX"| B["web01 www-data"]
    B -->|"SUID privesc"| C["web01 root"]
    C -->|"SSH key reuse"| D["db01 admin"]
    D -->|"DB access"| E["Customer PII"]
    
    style A fill:#e0e0e0
    style B fill:#ff9800
    style C fill:#f44336
    style D fill:#f44336
    style E fill:#9c27b0

Output Format

The skill produces one or more files:

/tmp/pentest/{target}/reports/
├── {target}_pentest_report.md        # Full Markdown report
├── {target}_pentest_report.docx      # Word deliverable (if requested)
├── {target}_pentest_report.pdf       # PDF deliverable (if requested)
├── {target}_executive_summary.md     # Standalone exec summary
└── {target}_remediation_roadmap.md   # Standalone remediation plan

Quality Checklist (Review Before Delivery)

More from this repository

same repository

active-directory

az0307/Aurora-AI-Agency

Active Directory and Windows domain attack techniques including domain enumeration, Kerberos attacks, credential relay, lateral movement, and domain privilege escalation for internal penetration testing engagements. Use this skill whenever the user mentions Active Directory, AD attacks, domain enumeration, BloodHound, Kerberoasting, AS-REP roasting, pass the hash, pass the ticket, overpass the hash, golden ticket, silver ticket, DCSync, DCShadow, NTDS.dit extraction, LDAP enumeration, domain controller, Group Policy abuse, ACL abuse, delegation abuse, constrained delegation, unconstrained delegation, resource-based constrained delegation, ADCS attacks, certificate abuse, LAPS, gMSA, domain trust attacks, forest trust, or any Windows domain-focused penetration testing activity. Also trigger for: impacket, crackmapexec, evil-winrm, bloodhound-python, kerbrute, responder, ntlmrelayx, petitpotam, certipy, rubeus, mimikatz, powerview, sharphound, enum4linux, smbclient, rpcclient, "enumerate the domain", "dump doma

2026-06-253

audit-logger

az0307/Aurora-AI-Agency

Security engagement audit logging, evidence chain management, and compliance trail for penetration testing. Use this skill whenever the user mentions audit log, audit trail, engagement logging, evidence collection, chain of custody, compliance logging, pentest logging, tool execution logging, JSONL log, activity log, forensic evidence, engagement timeline, or any request to log, track, or document security testing activities. Also trigger for: "log this action", "create audit trail", "evidence chain", "what did we do", "engagement timeline", "export activity log", or when any other security skill needs to record its actions for compliance. This skill is called BY other skills — it is the universal logging layer.

2026-06-253

credential-attack

az0307/Aurora-AI-Agency

Password cracking, credential brute force, hash analysis, and authentication testing for penetration testing engagements. Use this skill whenever the user mentions password cracking, hash cracking, brute force attack, credential spraying, password spray, dictionary attack, hashcat, john the ripper, hydra, medusa, credential stuffing, NTLM hash, NTHash, NetNTLMv2, Kerberos ticket cracking, AS-REP roasting, Kerberoasting, hash identification, rainbow tables, wordlist generation, custom wordlists, CeWL, crunch, cupp, password policy analysis, or any request to crack, guess, or test credentials. Also trigger for: "crack these hashes", "brute force this login", "test default credentials", "generate a wordlist", "what hash type is this", "password audit", or any credential-related testing activity. Expert tools: hashcat (GPU), john (CPU), hydra (online brute force), crackmapexec (network cred testing), medusa (parallel brute force).

2026-06-253

ctf-walkthrough

az0307/Aurora-AI-Agency

Generate structured CTF walkthrough writeups from engagement data, findings, and attack paths. Use this skill whenever the user mentions CTF writeup, walkthrough, write-up, CTF solution, box writeup, challenge writeup, HackTheBox writeup, TryHackMe writeup, "write up this box", "document how I solved", "create a walkthrough for", or any request to document a CTF/lab solution in educational format. Also trigger for: "writeup for HTB", "THM walkthrough", "document the attack path", "how did we solve this", or when red-team-report is called with engagement type CTF. Produces clean Markdown writeups with technique explanations, command output, and learning notes — suitable for blog posts or portfolio.

2026-06-253

exploit-dev

az0307/Aurora-AI-Agency

Exploit research, proof-of-concept development, controlled exploitation, and initial access verification for penetration testing engagements. Use this skill whenever the user mentions exploit development, PoC creation, Metasploit module execution, searchsploit, payload generation, msfvenom, exploit testing, vulnerability exploitation, initial access, shell access, reverse shell, bind shell, exploit chain, privilege escalation exploits, buffer overflow, web shell upload, or "can we exploit this finding". Also trigger for: ExploitDB search, Metasploit framework usage, custom exploit writing, payload encoding, exploit adaptation, weaponization, or any request to move from identified vulnerability to confirmed access. This is phase three of a pentest — trigger after vuln-analysis confirms exploitable findings, or standalone when the operator has a specific CVE. CRITICAL: All exploitation requires human approval before execution. The AI prepares commands and payloads but the operator confirms each run.

2026-06-253

network-forensics

az0307/Aurora-AI-Agency

Network traffic capture, packet analysis, protocol dissection, and digital evidence preservation for security engagements. Use this skill whenever the user mentions packet capture, pcap analysis, Wireshark, tshark, tcpdump, network forensics, traffic analysis, protocol analysis, packet inspection, network evidence, DNS analysis from captures, HTTP traffic extraction, credential sniffing from pcap, malware traffic analysis, C2 detection, network timeline reconstruction, or any task involving captured network data. Also trigger for: "capture traffic", "analyze this pcap", "what's in this capture", "extract files from pcap", "find credentials in traffic", "reconstruct network session", or any network evidence analysis task. Expert tools: tshark (CLI analysis), tcpdump (capture), Wireshark (GUI), NetworkMiner (artifact extraction), zeek (protocol logging).

2026-06-253