菜单
Use when aggregating findings from multiple security scans (secret-scan, dependency-scan, image-scan, DAST, cloud-posture, IAM review) into a single severity-grouped report for the security team or stakeholders, or "/pentest-report".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
| name | pentest-report |
| description | Use when aggregating findings from multiple security scans (secret-scan, dependency-scan, image-scan, DAST, cloud-posture, IAM review) into a single severity-grouped report for the security team or stakeholders, or "/pentest-report". |
| tools | ["cursor","claude","copilot"] |
Normalize all findings to one shape:
id: <stable-id> # e.g. CVE-id, finding hash
source: gitleaks | trivy | prowler | zap | manual | …
severity: critical | high | medium | low | info
title: <short>
where: <file:line | URL | ARN | resource id>
evidence: <redacted snippet>
why: <attack path, 1–2 sentences>
fix: <concrete remediation>
references: [CWE-…, CVE-…, OWASP A…]
owner: <team / person>
sla: <date by severity>
Deduplicate. The same vulnerable lib will show in trivy + osv-scanner + npm audit. Pick the most actionable record.
Bucket and sort. Critical → High → Medium → Low → Info. Within each, group by component (frontend, backend, infra, cloud).
Set SLAs by severity (default; user can override):
Compute deltas if a previous report exists: new / fixed / still-open / regressed.
Add an executive summary — 5 sentences max, no jargon, ship/no-ship recommendation.
Sanitize. No raw secrets, tokens, PII, customer ids, or third-party data. Redact (AKIA****WXYZ, user_****1234).
# Security assessment — <service / scope>
**Date:** <YYYY-MM-DD>
**Author:** pentest agent
**Scope:** repo `<name>` @ commit `<sha>`, image `<image:tag>`, AWS account `<id>`, staging `https://<host>`
**Authorization:** <localhost | staging owner-asserted | prod ref:<ticket>>
**Tools:** gitleaks 8.x, trivy 0.50, prowler 4.x, zap-baseline 2.14, semgrep <ver>
## Executive summary
<5 sentences, plain English. Highlight the top risk and the recommendation.>
**Recommendation:** ship | mitigate-then-ship | block
## Findings overview
| Severity | Count | New | Fixed since last | SLA |
|---|---|---|---|---|
| Critical | 2 | 1 | 0 | 24h |
| High | 5 | 2 | 1 | 7d |
| Medium | 11 | 4 | 3 | 30d |
| Low | 18 | 6 | 4 | 90d |
| Info | 22 | – | – | – |
## Critical findings
### C-001 — Exposed `.git/` on staging
- **Source:** zap-baseline
- **Where:** `https://staging.example.com/.git/config`
- **Why:** full source + history downloadable; secrets in history exploitable.
- **Fix:** block `/.git/` at CDN; rebuild deploy artifact without `.git`; rotate any historical secrets.
- **Owner:** Platform team
- **SLA:** 2026-04-28
- **Refs:** CWE-538
### C-002 — IAM user `legacy-deploy` has `*:*`
- (full record)
## High findings
…
## Medium findings
…
## Out of scope / not tested
- Authenticated user-to-user IDOR (no test accounts provided).
- Mobile clients.
- Third-party SaaS integrations (need their cooperation).
## Compliance snapshot
- CIS AWS 2.0: 78% pass
- OWASP ASVS L1: 85% pass; gaps in V2.1, V4.1.
## Trend
- Last report (2026-01-15): 14 open. Today: 38 open. **Regression** driven by new public endpoint and new dependencies.
## Recommended program improvements
- [ ] Add `gitleaks` pre-commit hook (prevents C-001 class).
- [ ] Add `osv-scanner` to CI (blocks Critical/High runtime CVEs).
- [ ] Quarterly prowler scan with diff vs prior.
- [ ] Threat-model template for every new public endpoint.
---
**Distribution:** security@, eng-leads@. Do not forward externally without redaction review.