ワンクリックで
Generate professional penetration testing reports from findings
npx skills add https://github.com/TheophilusChinomona/athena-pentest --skill pentest-reportこのコマンドをClaude Codeにコピー&ペーストしてスキルをインストール
Generate professional penetration testing reports from findings
npx skills add https://github.com/TheophilusChinomona/athena-pentest --skill pentest-reportこのコマンドをClaude Codeにコピー&ペーストしてスキルをインストール
API security testing — REST, GraphQL, authentication, authorization, rate limiting, business logic
Network penetration testing — service enumeration, vulnerability scanning, credential auditing, Active Directory
Master pentest orchestration — full pipeline from target to report with confirmation gates
Comprehensive reconnaissance — passive OSINT, subdomain enumeration, port scanning, technology fingerprinting
Web application penetration testing — XSS, SQLi, CSRF, SSRF, command injection, file upload, WAF bypass
Code security testing — SAST, SCA, secret detection, container scanning, IaC analysis
name: pentest_report description: Generate professional penetration testing reports from findings triggers:
Generate structured, professional vulnerability reports from pentest findings.
Generate markdown report convertible to PDF. Structure follows PTES/OWASP standards.
# Penetration Test Report
## Engagement Details
- **Client:** {client_name}
- **Target:** {target}
- **Date:** {start_date} — {end_date}
- **Tester:** Hermes Agent (Athena Pentest)
- **Scope:** {scope_description}
## Executive Summary
{2–3 paragraph non-technical summary of findings, risk level, key recommendations}
### Risk Overview
| Severity | Count |
|----------|-------|
| Critical | {n} |
| High | {n} |
| Medium | {n} |
| Low | {n} |
| Info | {n} |
## Methodology
{Recon → Enumeration → Vulnerability Scanning → Exploitation → Reporting}
## Findings
### CRITICAL-001: {Title}
- **Severity:** Critical
- **CVSS Score:** {score}
- **Affected:** {endpoint/host/port}
- **Description:** {what was found}
- **Evidence:** {command output, curl reproduction, screenshot reference}
- **Impact:** {business impact — data breach, RCE, etc.}
- **Remediation:** {specific fix steps}
- **References:** {CVE, CWE, OWASP link}
[Repeat for HIGH, MEDIUM, LOW...]
## Network Summary
### Open Ports & Services
| Host | Port | Service | Version | Notes |
|------|------|---------|---------|-------|
## Web Application Summary
### Endpoints Tested
- Total endpoints: {n}
- Vulnerable endpoints: {n}
### Vulnerabilities by OWASP Category
| Category | Found | Severity |
|----------|-------|----------|
## Recommendations
### Immediate (Critical/High)
1. {action item}
### Short-term (Medium)
1. {action item}
### Long-term (Low/Info)
1. {action item}
## Appendix
- Tool output summaries
- Evidence file list
- Wordlists used
- Scope confirmation
Before generating, collect all findings:
find /tmp/pentest/{target}/ -name "*.txt" -o -name "*.json" -o -name "*.md" | sort
cat /tmp/pentest/{target}/nuclei-*.txt
cat /tmp/pentest/{target}/nmap-*.nmap
cat /tmp/pentest/{target}/web-findings.md
cat /tmp/pentest/{target}/network-findings.md
Aggregate into /tmp/pentest/{target}/findings.json using the aggregate-results.sh script.
| Severity | Criteria |
|---|---|
| Critical | RCE, SQLi with data access, auth bypass, unauthenticated admin |
| High | Stored XSS, SSRF with internal access, privilege escalation, sensitive data exposure |
| Medium | Reflected XSS, CSRF on important functions, weak password policy, missing security headers |
| Low | Information disclosure, verbose errors, missing rate limiting |
| Info | Best practice recommendations, theoretical findings |
pandoc report.md -o report.pdf --pdf-engine=wkhtmltopdf
/tmp/pentest/{target}/report-{date}.md/tmp/pentest/{target}/evidence-{date}.tar.gz/tmp/pentest/{target}/findings.json