| name | pentest-report |
| description | Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending to the client. |
| license | MIT |
| metadata | {"version":"1.0.0","author":"Rifteo","tags":["pentest","audit","report","deliverable","findings"]} |
Pentest Report Generator
Turn all findings from a testing engagement into a single, client-ready penetration test report. Auditors spend 30-40% of engagement time on reporting. This skill handles the structure, ordering, and framing — you provide the findings.
What You Need Before Starting
- Confirmed findings (from
finding-writer)
- Engagement scope and target (from
ENGAGEMENT.md or scope-grill output)
- Test dates and tester names (ask if not available)
Report Structure
Generate each section in order. See references/report-template.md for the full template.
1. Cover Page
Client name, engagement title, date range, classification (Confidential), prepared by.
2. Executive Summary
3-5 paragraphs. Written for a non-technical audience (C-suite, board).
- What was tested and why
- Overall risk posture in plain language
- The single most critical finding, in business terms
- Top 3 recommended actions
Do not use technical jargon. Do not list every finding. See references/exec-summary-guide.md.
3. Scope and Methodology
- In-scope targets (from ENGAGEMENT.md)
- Out-of-scope items
- Test type (black/grey/white box)
- Test dates
- Tools and techniques used (high level)
- Limitations and caveats
4. Risk Summary Table
| # | Title | Severity | Component | Status |
|---|
| F-01 | SQL Injection in /api/search | Critical | API | Confirmed |
Order by severity (Critical → High → Medium → Low → Info).
5. Technical Findings
One section per finding, in the same order as the risk table. Each finding uses the full finding-writer format:
Title, Severity, CVSS, Description, Evidence, Impact, Recommendation, References.
6. Recommendations Summary
Ordered action list — immediate (Critical/High) first, then Medium, then hardening.
Cross-reference finding IDs (F-01, F-02...).
7. Appendices (if applicable)
- Full tool output
- Scope confirmation letter reference
- Methodology references
Rules
- The executive summary must be understandable by someone with no security background
- Never include unconfirmed findings — mark suspected issues as "Out of Scope" or "Requires Further Testing"
- Every finding in the report must have a corresponding ID in the risk table
- Do not pad with generic security advice unrelated to the engagement
- Ask for test dates and tester name if ENGAGEMENT.md is missing
