Assemble a complete penetration test / security assessment report from a set of findings and engagement scope. Use at the end of an engagement to produce the deliverable document. Composes individual findings and an executive summary.
Scanned 9/19/2026
Skills Directorynpx -y skills add jassics/awesome-claude-security --skill pentest-report --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Pentest Report?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/jassics-pentest-report)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: pentest-report
description: >-
Assemble a complete penetration test / security assessment report from a set
of findings and engagement scope. Use at the end of an engagement to produce
the deliverable document. Composes individual findings and an executive summary.
---
# Goal
A client-ready assessment report with a consistent structure, an executive
summary leadership can read, and detailed findings engineers can act on.
# Report structure
1. **Cover & metadata** — client, engagement type, dates, testers, version,
classification/handling label.
2. **Executive summary** — see `/security-reporting:executive-summary`; risk
posture in business terms, headline findings, overall rating.
3. **Scope & methodology** — what was in/out of scope, rules of engagement,
testing window, methodology/standards followed (PTES, OWASP WSTG, OSSTMM,
NIST 800-115), the severity-scoring standard (CVSS v4.0), and
limitations/caveats.
4. **Findings summary** — table: ID · Title · Severity · CVSS 4.0 score ·
Status, plus a severity-count chart (defer the chart to
`security-diagramming:infographic`).
5. **Detailed findings** — each via `/security-reporting:finding`, ordered by
severity.
6. **Remediation roadmap** — prioritized, with suggested timelines/owners.
7. **Appendices** — tooling, raw output refs, retest results, glossary.
# Steps
1. Collect all findings and confirm each is CVSS 4.0-scored (via
`/security-reporting:cvss`, not hand-computed) and deduplicated.
2. Derive the overall risk rating from the finding distribution + business context.
3. Generate the executive summary and the findings table.
4. Embed diagrams (attack trees / architecture) from `security-diagramming`.
5. Output as Markdown (and offer HTML/PDF). If integrations are configured,
offer to publish to Confluence or attach to a Jira epic.
# Output
The full report document, plus a separate one-page executive summary and a
findings CSV/table suitable for tracking.
# Notes
Keep the executive summary jargon-free; keep detailed findings precise and
evidence-backed. Never include live credentials or unredacted PII in the report.
Severity throughout the report is CVSS v4.0 — if any finding was scored before
this plugin's CVSS 4.0 rewrite, re-score it rather than mixing 3.1 and 4.0
numbers in the same findings table.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
