원클릭으로 Manus에서 모든 스킬 실행

report-writeup

스타2

포크0

업데이트2026년 5월 4일 18:11

Use when the operator asks for a written report, briefing, executive summary, customer deliverable, engagement write-up, or PoC findings doc. Produces PANW Cortex-style two-section output (executive + technical) with consistent formatting.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

hankthebldr

hankthebldr/dot-files

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Report writeup (Cortex/PANW style)

Default deliverable shape. Used for engagement reports, PoC writeups, customer briefings, internal handoffs.

Two-section structure (mandatory)

1. Executive summary

One paragraph. Business language. Audience: CISO, risk officer, BU leader.
Names: the risk, the business impact, the recommended action.
No tool names. No CVE numbers. No XQL. No jargon that requires SOC fluency.
Lead with the risk, not the methodology.

2. Technical detail

Audience: SOC analyst, red team peer, detection engineer.
Sections, in order:
1. Scope — what was assessed, what was excluded, dates, authorization reference.
2. Methodology — tools, posture (passive/active tier), key configuration choices.
3. Findings — table, ranked by severity. Each row: id, severity, asset, finding, evidence excerpt, recommended remediation.
4. IOCs (when applicable) — defanged, with context. Reference iocs-extract skill output.
5. Recommended detections — XSIAM/XDR rule sketches. XQL preferred. Tag with MITRE ATT&CK technique IDs.
6. Reproduction steps — terse, ordered list. Operator can rerun.
7. Open questions / followups — explicit. Don't bury.

Style

Severity language: Critical / High / Medium / Low / Info. No "very serious", no "concerning".
Numbers over adjectives. "12 open Redis instances across 3 subnets" beats "many exposed Redis services".
Time is UTC. ISO 8601 format.
Code blocks for tool output, XQL, queries. Never inline-quote multi-line output.
Tables for findings, IOCs, scope. Markdown table format.
Mermaid for any topology, sequence, or data flow.

Cortex XSIAM/XDR detection sketch format

### Detection: <short name>
**ATT&CK:** Txxxx (Technique name)
**Severity:** High
**Confidence:** Medium

```xql
dataset = <source>
| filter <condition>
| comp count() as hits by <dimension>
| filter hits > <threshold>

False-positive risks: Tuning notes:


## Defaults

- **Length:** technical section as long as needed; executive ≤ 150 words.
- **Naming:** filename `engagement-<id>-report-YYYY-MM-DD.md`.
- **Storage:** lands in `$OBSIDIAN_VAULT/40-Findings/` via `/handoff` slash command (Phase 8).
- **Sanitization for cloud delivery:** when generating via Claude Code with sensitive data, route through `safeclaude` (DontFeedTheAI proxy, Phase 7).

이 저장소의 다른 Skills

같은 저장소

name

hankthebldr/dot-files

Use when … (one-line trigger: name the task, its inputs, and the situation it applies to). This sentence is what the model reads to decide whether to load the skill.

2026-06-242

docsync

hankthebldr/dot-files

Project-aware sync between a GitHub repo, its Things 3 project, and its Obsidian vault subdirectory. The repo NAME is the common key across all three surfaces. Use whenever an agent needs to create Things 3 todos tied to a repo, onboard a repo, or mirror a repo's key markdown into the vault. Replaces ad-hoc add_todo calls that silently land in the Inbox. Trigger on "docsync", "sync this repo to Things", "create a todo for {repo}", sprint planning that emits tasks, or any repo-scoped task capture.

2026-06-242

enrich-this-note

hankthebldr/dot-files

Analyze an Obsidian vault note and suggest enrichment — improved/missing frontmatter, 3-5 wikilinks to related vault notes, the right MOC to file it under, and a 1-sentence MOC summary. Use when the user asks to "enrich this note", wants frontmatter/tag/link/MOC suggestions for a note, or is triaging a _wip/ note. Suggests only; never overwrites frontmatter without confirmation.

2026-06-242

handoff

hankthebldr/dot-files

Generate a concise session-handoff summary — TL;DR, what changed, decisions taken, open items, and context for the next session — and optionally save it to the Obsidian vault _wip/ inbox via the capture skill. Use at the end of a working session, when switching context, or when the user says "handoff", "hand this off", "wrap up", "session summary", or "/handoff". Never include raw credentials or PII; use surrogates.

2026-06-242

obsidian-vault-capture

hankthebldr/dot-files

Capture research findings, slash-command output, decisions, or other substantive session output as a structured Obsidian note in Henry's vault. Use this skill automatically whenever a session produces output with lasting reference value — research conclusions, comparison/evaluation results, command output worth keeping, architecture decisions, or notable findings — even if the user does not explicitly say "save this to my vault." Trigger on phrases like "capture this," "save to my vault," "note this," "vault this," and as the default RECORD/REFLECT step in autonomous loops. This is the canonical way to write vault notes; do not hand-roll frontmatter or write notes ad hoc when this skill applies.

2026-06-242

project-init

hankthebldr/dot-files

Onboard a GitHub repo as a vault dev-project — resolve (or create, with confirmation) its Things 3 project, then scaffold Github-Projects/<repo>/ with the _MOC <repo>.md binding anchor via the vault-os MCP tools. Use when starting work on a new repo, or when the user says "onboard <repo>", "project-init <repo>", "set up docsync for <repo>", or before the first /sync-docs on a repo. One-time per repo; afterward docsync and /sync-docs take the deterministic binding path automatically.

2026-06-242

name	report-writeup
description	Use when the operator asks for a written report, briefing, executive summary, customer deliverable, engagement write-up, or PoC findings doc. Produces PANW Cortex-style two-section output (executive + technical) with consistent formatting.

Report writeup (Cortex/PANW style)

Default deliverable shape. Used for engagement reports, PoC writeups, customer briefings, internal handoffs.

Two-section structure (mandatory)

1. Executive summary

One paragraph. Business language. Audience: CISO, risk officer, BU leader.
Names: the risk, the business impact, the recommended action.
No tool names. No CVE numbers. No XQL. No jargon that requires SOC fluency.
Lead with the risk, not the methodology.

2. Technical detail

Audience: SOC analyst, red team peer, detection engineer.
Sections, in order:
1. Scope — what was assessed, what was excluded, dates, authorization reference.
2. Methodology — tools, posture (passive/active tier), key configuration choices.
3. Findings — table, ranked by severity. Each row: id, severity, asset, finding, evidence excerpt, recommended remediation.
4. IOCs (when applicable) — defanged, with context. Reference iocs-extract skill output.
5. Recommended detections — XSIAM/XDR rule sketches. XQL preferred. Tag with MITRE ATT&CK technique IDs.
6. Reproduction steps — terse, ordered list. Operator can rerun.
7. Open questions / followups — explicit. Don't bury.

Style

Severity language: Critical / High / Medium / Low / Info. No "very serious", no "concerning".
Numbers over adjectives. "12 open Redis instances across 3 subnets" beats "many exposed Redis services".
Time is UTC. ISO 8601 format.
Code blocks for tool output, XQL, queries. Never inline-quote multi-line output.
Tables for findings, IOCs, scope. Markdown table format.
Mermaid for any topology, sequence, or data flow.

Cortex XSIAM/XDR detection sketch format

### Detection: <short name>
**ATT&CK:** Txxxx (Technique name)
**Severity:** High
**Confidence:** Medium

```xql
dataset = <source>
| filter <condition>
| comp count() as hits by <dimension>
| filter hits > <threshold>

False-positive risks: Tuning notes:


## Defaults

- **Length:** technical section as long as needed; executive ≤ 150 words.
- **Naming:** filename `engagement-<id>-report-YYYY-MM-DD.md`.
- **Storage:** lands in `$OBSIDIAN_VAULT/40-Findings/` via `/handoff` slash command (Phase 8).
- **Sanitization for cloud delivery:** when generating via Claude Code with sensitive data, route through `safeclaude` (DontFeedTheAI proxy, Phase 7).