finding-report
Generate a structured pentest finding report in markdown. Use when documenting a vulnerability, writing up a finding, or creating engagement notes.
来源信息
- 仓库
- SpecterOps/skills
- 最近来源活动
- 2026年8月14日 01:16
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 689
- 分支
- 77
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
文件资源管理器
4 个文件正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- finding-report
- description
- Generate a structured pentest finding report in markdown. Use when documenting a vulnerability, writing up a finding, or creating engagement notes.
- metadata
- {"author":"GhostWorks"}
# Pentest Finding Report
Generate a structured markdown finding report suitable for inclusion in a professional penetration test report.
Parse the user's input to determine the finding title and severity:
- `$finding-report "Kerberoastable Service Account with Path to DA"` → create finding with default High severity
- `$finding-report "Open S3 Bucket" --severity critical` → create finding with specified severity
- `$finding-report` → ask for a title
## Steps
1. Create the output directory if it doesn't exist (`mkdir -p findings/`) and create a new file at `findings/<title-slugified>.md` (convert title to kebab-case)
2. Use this template structure:
```markdown
# [Title]
| Field | Value |
|---|---|
| **Severity** | [Critical/High/Medium/Low/Info] |
| **CVSS 3.1** | [Score] ([Vector String]) |
| **CWE** | [CWE-ID: Name] |
| **Affected Asset(s)** | [hosts, URLs, or services] |
| **Status** | Open |
## Description
[2-3 sentences explaining what the vulnerability is and where it exists. Be specific about the affected component.]
## Impact
[What can an attacker achieve by exploiting this? Be concrete — data exposure, lateral movement, privilege escalation, etc.]
## Evidence
[Screenshots, command output, or proof. Use fenced code blocks for command output.]
```
[command or request used]
```
```
[response or output showing the vulnerability]
```
## Reproduction Steps
1. [Step-by-step instructions to reproduce]
2. [Be specific enough that another tester could verify]
3. [Include exact commands, URLs, parameters]
## Remediation
**Short-term**: [Immediate mitigation]
**Long-term**: [Root cause fix]
## References
- [Relevant CVE, blog post, or documentation]
```
3. Fill in the template based on the information provided. If information is missing, insert `[TODO: ...]` placeholders
4. For CVSS scoring, calculate based on the described impact:
- Network-accessible + no auth + high impact = Critical (9.0+)
- Requires auth or local access + high impact = High (7.0-8.9)
- Limited impact or requires chaining = Medium (4.0-6.9)
- Minor information disclosure = Low (0.1-3.9)
5. Map to appropriate CWE IDs (common ones):
- SQL Injection: CWE-89
- XSS: CWE-79
- Command Injection: CWE-78
- Path Traversal: CWE-22
- SSRF: CWE-918
- Broken Auth: CWE-287
- IDOR: CWE-639
- Weak Crypto: CWE-327
- Kerberoasting: CWE-916
- ACL Misconfiguration: CWE-732
- Certificate Template Abuse: CWE-295
6. Report the file path back to the user
在 GitHub 查看