| name | generating-executive-summary |
| description | Compose an exec-readable summary from a unified findings JSONL
plus the OWASP coverage report. Computes a single engagement
risk score (0-100, severity-weighted with OWASP-breadth and
governance terms), rolls up findings into headline counts, names
the top-3 remediation priorities with effort + impact estimates,
and produces a 1-2 page markdown document for a C-level or board
audience. Elides technical detail; the vulnerability report is
the deep document.
Use when: closing an engagement, preparing the exec-readout
meeting, packaging for board review, or producing a one-page
narrative for auditor / insurer / board.
Threshold: input findings missing produces CRITICAL operational
finding; otherwise the deliverable is the document itself.
Trigger with: "generate exec summary", "executive summary",
"C-level readout", "board pentest summary".
|
| allowed-tools | ["Read","Write","Bash(python3:*)","Glob"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)","Bash(wget:*)","Write(.env)","Edit(.env)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","reporting","executive-summary","risk-score","pentest"] |
Generating Executive Summary
Overview
The vulnerability report is comprehensive — every finding, full
detail, every reference. The C-level reader doesn't open it. They
ask their security lead "what should I tell the board?" The
security lead needs a one-page answer.
That one-page answer is the executive summary. It states the
engagement's bottom line:
- A single risk score (0-100)
- Headline counts by severity
- Top-3 remediation priorities, each with rough effort + impact
- OWASP Top 10 coverage (where the work landed)
- Engagement scope and authorization summary (what was tested,
under what authority, in what window)
- Next steps the customer's organization should take
The summary doesn't omit anything important; it just compresses.
The vulnerability report remains the deep artifact for anyone who
needs the technical detail.
This skill consumes the enriched findings JSONL (after OWASP
mapping) + the OWASP coverage report + the ROE, computes the risk
score, picks the top remediation priorities deterministically,
and renders the document.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| Input findings file missing | CRITICAL | Source JSONL doesn't exist | (operational) |
| OWASP coverage report missing | HIGH | Coverage referenced but not present | (operational) |
| ROE missing | MEDIUM | Can still generate summary but lacks scope/authz context | (operational) |
| Exec summary written cleanly | INFO | Confirmation | (informational) |
| Risk score >75 (high engagement risk) | HIGH | Computed risk score elevated | (advisory) |
| Risk score >90 (critical engagement risk) | CRITICAL | Engagement exposed material risk; needs urgent action | (advisory) |
Risk score (0-100) composition
The single risk score is the headline number on the exec summary.
The composition is deterministic and documented:
risk = clamp(0, 100,
20 * count(CRITICAL)
+ 10 * count(HIGH)
+ 3 * count(MEDIUM)
+ 1 * count(LOW)
+ 0 * count(INFO)
+ 5 * (count(distinct OWASP categories touched) - 5 if >5 else 0)
- 10 * 1 if engagement was authorized cleanly and in-scope (governance bonus)
)
