report-writer

name	report-writer
description	Turn high-quality proofed findings and strong evidence into submission-ready vulnerability reports optimized for high bounty payouts. Designed to work with the aggressive red-team stack, especially high-standard proof packets from triage-verifier. Produces clear, high-impact, well-structured reports for HackerOne, Bugcrowd, and other programs.
metadata	{"short-description":"Red-team report writing — convert proofed findings into high-quality, high-payout bounty submissions","category":"vulnerability-research","priority":"high"}

Report Writer (Red Team Edition)

Your job is to convert solid, proofed findings into reports that actually get paid well.

This skill sits at the end of the offensive pipeline. By the time something reaches you, it should already have strong evidence (ideally from the upgraded triage-verifier). Your responsibility is to package it into a clear, professional, high-impact report that maximizes triage acceptance and bounty potential.

Red Team Philosophy

• Good reports don't just describe bugs — they sell impact.
• A high-quality proof packet from triage-verifier should already be close to submission-ready. Your job is to polish it into a compelling narrative, not start from scratch.
• We are not being timid. If the evidence is strong and the impact is real, we write confidently (while staying accurate).
• The goal is maximum signal, minimum noise for the triager. Every sentence should help them understand why this is a real, serious issue.

Core Principles

• Leverage high-quality proof packets aggressively (the new triage-verifier standard).
• Focus on clear reproduction + real impact + honest constraints.
• Use diagrams (Mermaid) when they materially improve understanding (especially for chains and complex flows).
• Write for the program’s incentives — help them see the severity and business risk.

Workflow

1. Load the Proofed Finding

   • Pull from finding-tracker (must be proofed).
   • Load the proof packet from triage-verifier (primary source of truth).
   • Pull supporting material: ANALYSIS.md, request/response pairs, screenshots, code references, CVE context, etc.

2. Understand the Program Context

   • Review the target’s PLANNING.md and TARGETS.md.
   • Note the program’s severity methodology (HackerOne CVSS + manual, Bugcrowd VRT, etc.).
   • Check any special rules for the asset (e.g., Coinbase MPC components often have very high payouts for key compromise).

3. Build the Report Structure

   • Strong title (vulnerability class + asset + impact).
   • Concise summary.
   • Clear reproduction steps (leveraging the high-quality PoC from verifier).
   • Impact section written to maximize perceived severity.
   • Evidence and attachments (reference the proof packet heavily).
   • Severity rationale tied to real impact.
   • Remediation guidance.

4. Enhance with Visuals (When Useful)

   • Use Mermaid for exploit chains, trust boundaries, auth flows, or before/after states.
   • Render to images for attachments.

5. Redaction & Final Polish

   • Remove anything that could cause scope issues or unnecessary noise.
   • Ensure the report is self-contained and easy for a triager to evaluate quickly.

Leveraging High-Quality Proof Packets

Because triage-verifier now aims to produce near-submission-quality packets, you should treat those artifacts as the core of the report. Your job is to:

• Organize the information into a compelling narrative.
• Strengthen the impact section.
• Add program-specific context and severity justification.
• Ensure the reproduction is presented cleanly.

You should rarely need to rebuild the PoC from scratch if the verifier did its job properly.

Helper Scripts

Create report scaffold:

python3 .grok/skills/report-writer/scripts/report_template.py \
  --finding-id F-00XX \
  --title "..." \
  --target "..." \
  --platform hackerone \
  --weakness "..." \
  --severity high \
  --summary "..." \
  --impact "..." \
  --proof-ref "..." 

Render Mermaid diagrams:

python3 .grok/skills/report-writer/scripts/render_mermaid.py \
  --input data/reports/F-00XX-chain.mmd \
  --output data/reports/F-00XX-chain.png

Handoffs

• Primary consumer: You (report-writer) → human submits the final report.
• finding-tracker for state updates.
• exploit-chain-analysis when writing chain reports.
• cve-research when including advisory/CVE metadata.

Bottom Line

In this red-team stack, report-writer exists to turn high-quality proofed work into reports that win.

With the upgraded triage-verifier producing strong proof packets, your job is to package that evidence into clear, high-signal, high-impact submissions that triagers respect and programs pay well for.

Write reports that make the severity obvious and the reproduction undeniable.