| name | transilience-report-style |
| description | Generate a Transilience-branded PDF report (pentest, vuln assessment, compliance, threat intel) from a single findings JSON using the bundled ReportLab generator. Use whenever an engagement needs its final report/deliverable PDF in Transilience house style. |
Transilience Report Style
Turns a structured findings JSON into a branded A4 PDF (light theme by default — modern/minimal; --theme dark fallback; brand gradient rule, boxed code/samples, framed screenshots, colour-coded severity + CVSS-score, findings cards, severity metrics) — the standard Transilience deliverable. The generator is data-driven: you assemble one JSON, run one command. Design system: formats/transilience-report-style/SKILL.md §0 (theme/palette).
When to use
- A pentest / vuln-assessment / network-scan / compliance engagement is finished and validated and needs its PDF deliverable.
- You already have findings (ideally validated) with severity + CVSS + evidence + remediation.
How to use (3 steps)
-
Write report_data.json matching reference/report-data-schema.json. Only engagement and findings are required; every other key (executive_summary, metrics, sections, cve_register, coverage_table, attack_pattern_coverage, ruled_out, tools_used, roadmap, disclaimer) is an optional section that is skipped if absent. See reference/example-report-data.json for a minimal working file.
- Internal-only sections: a
sections[] entry with "internal": true is retained in report_data.json (kept as the internal record) but is never rendered into the client PDF. Use it for internal QA logs such as blind-validation / independent-reproduction verdict tables — these must not appear in any client-facing PDF.
-
Run the generator:
python3 reference/generate_report.py <report_data.json> -o reports/My-Report.pdf
Fonts + logo are auto-discovered from formats/transilience-report-style/. Override with --assets <dir> if running outside the repo. Requires reportlab (pip install reportlab).
-
Verify by rendering a page (pdftoppm -png -r 100 -f 1 -l 1 out.pdf /tmp/p) and reading it before delivery.
What it renders
Cover (logo, title lines, subtitle, metadata) → Executive Summary (auto KPI metric boxes from severity counts + narrative + key risks + positives) → free-form sections (Scope/Methodology) → finding cards grouped Critical→Info (severity bar, CVSS+vector, CWE/OWASP, status, affected, description, impact, optional PoC block — ordered steps each with prose + code-styled command + embedded screenshot, optional severity-calibration, optional per-finding CVE table, remediation) → optional CVE register, coverage table, Attack Pattern Coverage (deterministic surface-unit × attack-class matrix with colour-coded status), ruled-out appendix, Tools & Techniques Used, remediation roadmap, disclaimer. Section numbers are assigned automatically.
Finding object (the important fields)
id, title, severity (Critical|High|Medium|Low|Info), cvss_score, cvss_vector, cwe, owasp, affected[], description, impact, recommendation + optional poc[], calibration, needs_live_confirmation, cves[]. poc is an ordered list of steps {description, command, image_url} (it merges the former evidence / poc_request / screenshot fields): each renders as a numbered prose description, an optional code-styled command, and an optional embedded image. PAN/Aadhaar/card-like values are defensively masked at render time — but redact real secrets/PII in your source text anyway.
Conventions
- Severity is set by the CVSS band (≥9 Critical, ≥7 High, ≥4 Medium, >0 Low, 0 Info) unless deliberately env-adjusted — state the calibration in the
calibration field (see formats/transilience-report-style/pentest-report.md §7).
- No emoji; text severity labels only. Finding metadata as fields, not prose.
- One finding = one validated issue. Group systemic instances rather than repeating near-duplicates.
References
