pentest-report

name

pentest-report

description

Generates standardized penetration test reports in DOCX, PDF, and HTML formats. Use this skill when you need to produce a security assessment report from pentest findings, vulnerability scan results, or security testing output. Triggers when user asks to "generate a report", "create a pentest report", "build a security report", "export findings", or any request to turn security testing results into a deliverable document. Supports customizable templates and severity-based formatting.

Pentest Report Generator

Generates professional penetration test reports from structured findings data. Outputs DOCX (editable), PDF (distribution), and HTML (review) formats.

Workflow

1. Collect findings from the user or pentest conversation
2. Structure as JSON using the schema below
3. Run the generator via scripts/generate.py
4. Deliver the output files to the user

Input JSON Schema

The generator expects a JSON file with this structure:

{
  "config": {
    "organization": "Org Name",
    "logo": "path/to/logo.png",
    "colors": { "primary": "#425363", "critical": "#91243E", ... }
  },
  "report": {
    "title": "Web Application Security Assessment: Target Name",
    "date": "2025-01-15",
    "classification": "Confidential",
    "executive_summary": "Brief overview...",
    "scope": "Scope description...",
    "methodology": "Testing methodology..."
  },
  "findings": [
    {
      "id": "PTS-001",
      "name": "SQL Injection in Login Form",
      "severity": "critical",
      "cvss_score": 9.8,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "cwe": "CWE-89",
      "owasp": "A03:2021-Injection",
      "wasc": "WASC-19",
      "cve": "",
      "description": "SQL injection was discovered in...",
      "impact": "An attacker could...",
      "remediation": "Use parameterized queries...",
      "references": ["https://owasp.org/...", "https://cwe.mitre.org/..."],
      "instances": [
        {
          "url": "https://example.com/login",
          "method": "POST",
          "parameter": "username",
          "request": "POST /login HTTP/1.1...",
          "response": "HTTP/1.1 500..."
        }
      ]
    }
  ],
  "summary": {
    "critical": 0,
    "high": 1,
    "medium": 2,
    "low": 3,
    "info": 5,
    "total": 11
  }
}

Finding Fields

Field	Required	Description
id	Yes	Unique identifier (e.g., PTS-001)
name	Yes	Finding title
severity	Yes	One of: critical, high, medium, low, info
cvss_score	No	CVSS numeric score
cvss_vector	No	CVSS vector string
cwe	No	CWE identifier
owasp	No	OWASP category
wasc	No	WASC threat classification
cve	No	CVE identifier
description	Yes	Detailed vulnerability description
impact	No	Business/technical impact
remediation	Yes	Remediation guidance
references	No	External reference URLs
instances	No	Evidence/instance details

Instance Fields

Field	Required	Description
url	Yes	Affected URL or endpoint
method	No	HTTP method (GET, POST, etc.)
parameter	No	Vulnerable parameter name
request	No	Example request (truncated if long)
response	No	Example response (truncated if long)

Generating the Report

Run the bundled generator script:

python scripts/generate.py \
  --input findings.json \
  --format all \
  --output output/

Arguments:

• --input: Path to findings JSON file (required)
• --format: html, docx, pdf, or all (default: all)
• --output: Output directory (default: output/)
• --config: Path to custom config.json (default: config.json)
• --template: Path to custom HTML template (default: templates/report.html)

Report Sections

The generated report includes these sections in order:

1. Cover Page — Title, target name, date, classification, organization logo
2. Table of Contents — Auto-generated from headings
3. Executive Summary — High-level overview and risk summary
4. Scope & Methodology — Testing scope and methodology description
5. Findings Summary — Severity breakdown table and counts
6. Detailed Findings — One section per finding with:
   • Severity badge and plugin/finding ID
   • Description and impact
   • Remediation guidance
   • Risk information (CVSS, CWE, OWASP, WASC)
   • Evidence/instances with request/response details
7. Appendices — References, glossary, methodology details

Customization

Organizations can customize:

• config.json: Logo, colors, organization name, default output format
• templates/report.html: Jinja2 template for HTML output styling
• Severity colors and labels in config.json

Bundled Resources

• scripts/generate.py — Main report generator (Python)
• scripts/docx_builder.py — DOCX generation with python-docx
• scripts/html_builder.py — HTML generation with Jinja2
• scripts/pdf_builder.py — PDF generation from HTML via WeasyPrint
• scripts/generate.py — CLI entry point (supports --format docx|html|pdf|all)
• templates/report.html — Jinja2 HTML template
• config.json — Default configuration
• template.md — Report format reference
• examples/sample_findings.json — Example input
• assets/ — Placeholder logo and static assets