sast-report

Name: sast-report
Author: utkusen

37installs56forks

How to install sast-report?

utkusen/sast-skills/sast-report

$npx -y skills add utkusen/sast-skills --skill sast-report

Installs into the current project.

Summary

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to gene

Files · 1

View on GitHub

SKILL.md

1	# Final Security Report Generation
2
3	You are consolidating all completed SAST vulnerability scan results into a single prioritized security report.
4
5	Prerequisites: At least one `sast/*-results.md` file must exist. Run the vulnerability detection skills first if they don't.
6
7	---
8
9	## What to Include
10
11	Only include findings with these classifications from each result file:
12	- `[VULNERABLE]`
13	- `[LIKELY VULNERABLE]`
14
15	Exclude `[NOT VULNERABLE]` and `[NEEDS MANUAL REVIEW]` findings from the main report body (count them only in the summary).
16
17	---
18
19	## Severity Ranking
20
21	Assign each finding a severity tier — Critical, High, Medium, or Low — using the table below as your baseline. Adjust up or down based on context (e.g., an IDOR that exposes financial records is High, not Medium).
22
23	\| Vulnerability Class \| Default Severity \|
24	\|---------------------\|------------------\|
25	\| RCE via command injection, eval, or unsafe deserialization \| Critical \|
26	\| SSTI (Server-Side Template Injection) \| Critical \|
27	\| SQLi on authentication endpoints \| Critical \|
28	\| JWT algorithm confusion (alg:none, RS256→HS256) \| Critical \|
29	\| File upload leading to code execution (webshell) \| Critical \|
30	\| SQLi with full data extraction capability \| High–Critical \|
31	\| GraphQL injection (user-controlled operation document enabling unauthorized fields or gateway abuse) \| High–Critical \|
32	\| XXE with file read or internal SSRF \| High–Critical \|
33	\| Missing authentication on sensitive endpoints \| High–Critical \|
34	\| SSRF reaching internal services or cloud metadata \| High \|
35	\| Path traversal reading sensitive or config files \| High \|
36	\| File upload with stored content accessible to others \| High \|
37	\| IDOR on PII, financial, or health data \| High \|
38	\| XSS (stored/persistent) \| High \|
39	\| JWT with missing or bypassable claim validation \| Medium–High \|
40	\| Missing authentication on lower-sensitivity endpoints \| Medium \|
41	\| IDOR on non-sensitive data \| Medium \|
42	\| XSS (reflected or DOM) \| Medium \|
43	\| Business logic flaws (price manipulation, workflow bypass) \| Medium \|
44	\| Information disclosure of non-sensitive data \| Low \|
45
46	Confidentiality as a tiebreaker: When two findings share the same baseline severity, rank higher the one with greater confidentiality impact — i.e., the greater its potential to expose sensitive user data, credentials, or system internals.
47
48	---
49
50	## Execution
51
52	Perform all steps in-session (no subagents needed).
53
54	### Step 1: Discover result files
55
56	Check which of these files exist in `sast/`:
57	- `idor-results.md`
58	- `sqli-results.md`
59	- `ssrf-results.md`
60	- `xss-results.md`
61	- `rce-results.md`
62	- `xxe-results.md`
63	- `fileupload-results.md`
64	- `pathtraversal-results.md`
65	- `ssti-results.md`
66	- `jwt-results.md`
67	- `missingauth-results.md`
68	- `businesslogic-results.md`
69	- `graphql-results.md`
70
71	Also read `sast/architecture.md` if it exists (use it for the project name and context when writing severity rationale).
72
73	### Step 2: Read and extract findings
74
75	Read each existing result file. For every finding classified as `[VULNERABLE]` or `[LIKELY VULNERABLE]`, extract:
76	- Finding title
77	- Vulnerability type (derived from the source file)
78	- File / endpoint affected
79	- Issue description
80	- Impact description
81	- Proof / code path
82	- Remediation
83	- Dynamic test steps (if present)
84
85	### Step 3: Score and sort
86
87	Assign each finding a severity level (Critical / High / Medium / Low) using the table above. Sort all findings:
88
89	1. Critical first, then High, Medium, Low
90	2. Within each tier, sort by confidentiality impact (highest first)
91
92	### Step 4: Write `sast/final-report.md`
93
94	Use exactly this output format:
95
96	---
97
98	```markdown
99	# Security Assessment Final Report
100
101	Project: [name from architecture.md, or infer from codebase]
102	Generated: [current date]
103	Scans completed: [comma-separated list of scan types that had result files]
104
105	---
106
107	## Executive Summary
108
109	\| Severity \| Count \|
110	\|----------\|-------\|
111	\| Critical \| N \|
112	\| High \| N \|
113	\| Medium \| N \|
114	\| Low \| N \|
115	\| Total confirmed findings \| N \|
116
117	Scans with no confirmed vulnerabilities: [list]
118	Findings requiring manual review: N (see individual result files for details)
119
120	---
121
122	## Vulnerability Index
123
124	\| # \| Title \| Type \| Severity \| Endpoint / File \|
125	\|---\|-------\|------\|----------\|----------------\|
126	\| 1 \| ... \| RCE \| Critical \| `POST /api/exec` \|
127	\| 2 \| ... \| SQLi \| High \| `GET /api/users` \|
128
129	---
130
131	## Findings
132
133	### Critical
134
135	#### [Finding Title] — [Vuln Type]
136
137	- Source scan: `sast/[type]-results.md`
138	- Classification: Vulnerable (or "Likely Vulnerable")
139	- Endpoint / File: ...
140	- Severity rationale: [1–2 sentences ex

People who liked this also viewed

6 picks

Type

sast-report

37installs56forks

View on GitHub

How to install sast-report?

utkusen/sast-skills/sast-report

$npx -y skills add utkusen/sast-skills --skill sast-report

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Final Security Report Generation
2
3	You are consolidating all completed SAST vulnerability scan results into a single prioritized security report.
4
5	Prerequisites: At least one `sast/*-results.md` file must exist. Run the vulnerability detection skills first if they don't.
6
7	---
8
9	## What to Include
10
11	Only include findings with these classifications from each result file:
12	- `[VULNERABLE]`
13	- `[LIKELY VULNERABLE]`
14
15	Exclude `[NOT VULNERABLE]` and `[NEEDS MANUAL REVIEW]` findings from the main report body (count them only in the summary).
16
17	---
18
19	## Severity Ranking
20
21	Assign each finding a severity tier — Critical, High, Medium, or Low — using the table below as your baseline. Adjust up or down based on context (e.g., an IDOR that exposes financial records is High, not Medium).
22
23	\| Vulnerability Class \| Default Severity \|
24	\|---------------------\|------------------\|
25	\| RCE via command injection, eval, or unsafe deserialization \| Critical \|
26	\| SSTI (Server-Side Template Injection) \| Critical \|
27	\| SQLi on authentication endpoints \| Critical \|
28	\| JWT algorithm confusion (alg:none, RS256→HS256) \| Critical \|
29	\| File upload leading to code execution (webshell) \| Critical \|
30	\| SQLi with full data extraction capability \| High–Critical \|
31	\| GraphQL injection (user-controlled operation document enabling unauthorized fields or gateway abuse) \| High–Critical \|
32	\| XXE with file read or internal SSRF \| High–Critical \|
33	\| Missing authentication on sensitive endpoints \| High–Critical \|
34	\| SSRF reaching internal services or cloud metadata \| High \|
35	\| Path traversal reading sensitive or config files \| High \|
36	\| File upload with stored content accessible to others \| High \|
37	\| IDOR on PII, financial, or health data \| High \|
38	\| XSS (stored/persistent) \| High \|
39	\| JWT with missing or bypassable claim validation \| Medium–High \|
40	\| Missing authentication on lower-sensitivity endpoints \| Medium \|
41	\| IDOR on non-sensitive data \| Medium \|
42	\| XSS (reflected or DOM) \| Medium \|
43	\| Business logic flaws (price manipulation, workflow bypass) \| Medium \|
44	\| Information disclosure of non-sensitive data \| Low \|
45
46	Confidentiality as a tiebreaker: When two findings share the same baseline severity, rank higher the one with greater confidentiality impact — i.e., the greater its potential to expose sensitive user data, credentials, or system internals.
47
48	---
49
50	## Execution
51
52	Perform all steps in-session (no subagents needed).
53
54	### Step 1: Discover result files
55
56	Check which of these files exist in `sast/`:
57	- `idor-results.md`
58	- `sqli-results.md`
59	- `ssrf-results.md`
60	- `xss-results.md`
61	- `rce-results.md`
62	- `xxe-results.md`
63	- `fileupload-results.md`
64	- `pathtraversal-results.md`
65	- `ssti-results.md`
66	- `jwt-results.md`
67	- `missingauth-results.md`
68	- `businesslogic-results.md`
69	- `graphql-results.md`
70
71	Also read `sast/architecture.md` if it exists (use it for the project name and context when writing severity rationale).
72
73	### Step 2: Read and extract findings
74
75	Read each existing result file. For every finding classified as `[VULNERABLE]` or `[LIKELY VULNERABLE]`, extract:
76	- Finding title
77	- Vulnerability type (derived from the source file)
78	- File / endpoint affected
79	- Issue description
80	- Impact description
81	- Proof / code path
82	- Remediation
83	- Dynamic test steps (if present)
84
85	### Step 3: Score and sort
86
87	Assign each finding a severity level (Critical / High / Medium / Low) using the table above. Sort all findings:
88
89	1. Critical first, then High, Medium, Low
90	2. Within each tier, sort by confidentiality impact (highest first)
91
92	### Step 4: Write `sast/final-report.md`
93
94	Use exactly this output format:
95
96	---
97
98	```markdown
99	# Security Assessment Final Report
100
101	Project: [name from architecture.md, or infer from codebase]
102	Generated: [current date]
103	Scans completed: [comma-separated list of scan types that had result files]
104
105	---
106
107	## Executive Summary
108
109	\| Severity \| Count \|
110	\|----------\|-------\|
111	\| Critical \| N \|
112	\| High \| N \|
113	\| Medium \| N \|
114	\| Low \| N \|
115	\| Total confirmed findings \| N \|
116
117	Scans with no confirmed vulnerabilities: [list]
118	Findings requiring manual review: N (see individual result files for details)
119
120	---
121
122	## Vulnerability Index
123
124	\| # \| Title \| Type \| Severity \| Endpoint / File \|
125	\|---\|-------\|------\|----------\|----------------\|
126	\| 1 \| ... \| RCE \| Critical \| `POST /api/exec` \|
127	\| 2 \| ... \| SQLi \| High \| `GET /api/users` \|
128
129	---
130
131	## Findings
132
133	### Critical
134
135	#### [Finding Title] — [Vuln Type]
136
137	- Source scan: `sast/[type]-results.md`
138	- Classification: Vulnerable (or "Likely Vulnerable")
139	- Endpoint / File: ...
140	- Severity rationale: [1–2 sentences ex

People who liked this also viewed

6 picks

Type