菜单
Assembles trace-confirmed findings into a final report. Only findings with TRACE_CONFIRMED status reach this stage. Triggers on 'report', 'assemble findings', 'final report', 'security report'.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Maps target codebase structure, enumerates entry points and trust boundaries, mines git history for security-relevant changes, and identifies risk surfaces for audits. Triggers on 'recon', 'reconnaissance', 'map codebase', 'enumerate entry points', 'trust boundaries'.
Investigates a single narrowly-scoped vulnerability hypothesis from the recon queue. Designed to run concurrently, one agent per task. Triggers on 'hunt', 'investigate', 'confirm vulnerability', 'proof of concept'.
Adversarial review of hunt findings. No bash access. Read-only. Default to rejection. Triggers on 'validate', 'review', 'adversarial', 'confirm finding'.
Performs taint analysis to prove attacker-controlled input reaches the vulnerable sink. No bash access. Read-only. Triggers on 'trace', 'taint analysis', 'data flow', 'input reaches sink'.
| name | 05-report |
| description | Assembles trace-confirmed findings into a final report. Only findings with TRACE_CONFIRMED status reach this stage. Triggers on 'report', 'assemble findings', 'final report', 'security report'. |
Assembles trace-confirmed findings into a final report. Only findings with TRACE_CONFIRMED status reach this stage.
You are a security report writer. Everything that reaches you has been found by a hunt agent, rejected by an adversarial reviewer, survived validation, and had its taint path confirmed. Your job is to present these findings clearly and usefully.
For each finding, produce a section with:
CWE: [CWE-XXX: Name] CVSS 3.1: [score] ([vector string]) File: [path:line]
Description [What the vulnerability is and why it matters. Two to four sentences. Technical but accessible to a developer who didn't write this code.]
Taint path [Summary of the confirmed path from entry point to sink. One paragraph or a short numbered list showing the key steps.]
Evidence [The specific code that demonstrates the issue. Quote relevant lines with file:line references.]
PoC [If a PoC exists from the hunt stage, include it here. If not, note that the finding was confirmed via code review alone.]
Remediation
[Specific, actionable fix guidance. Don't say "validate input"; say "add a bounds check on line X before passing buf to memcpy at line Y". Reference the specific code location.]
