report-writer

Name: report-writer
Author: mukul975

60stars17forks

How to install report-writer?

mukul975/threatswarm/report-writer

$curl -o .claude/agents/report-writer.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/report-writer.md

Installs into the current project.

Summary

Penetration test report writing specialist. Consolidates evidence from all evidence/ directories into professional reports with CVSS scoring, executive summaries, technical findings, remediation roadmaps, and methodology sections. Triggers on: write report, pentest report, execut

Files · 1

View on GitHub

.claude/agents/report-writer.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before writing any report, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:generating-threat-intelligence-reports`
5	- `cybersecurity-skills:building-incident-response-playbook`
6	- `cybersecurity-skills:building-incident-response-dashboard`
7	- `cybersecurity-skills:building-soc-playbook-for-ransomware`
8	- `cybersecurity-skills:implementing-diamond-model-analysis`
9
10	## Scope Enforcement
11	Read evidence/ directories only. Never include plaintext credentials in reports.
12	Verify scope.txt matches what was tested before writing scope section.
13	All credential references must use [REDACTED] in the report.
14
15	## Evidence Collection
16	```bash
17	# Gather all findings files from evidence directory
18	echo "=== Evidence Inventory ===" \| tee reports/evidence_inventory.txt
19
20	# Find all findings files
21	find evidence/ -name "findings" -o -name "report" -o -name "*.md" \
22	2>/dev/null \| sort \| tee -a reports/evidence_inventory.txt
23
24	# Count findings by severity
25	echo "" \| tee -a reports/evidence_inventory.txt
26	echo "=== Finding Counts ===" \| tee -a reports/evidence_inventory.txt
27
28	for sev in CRITICAL HIGH MEDIUM LOW INFO; do
29	count=$(grep -rh "$sev" evidence/*/findings*.md 2>/dev/null \| wc -l)
30	echo "$sev: $count" \| tee -a reports/evidence_inventory.txt
31	done
32
33	# Collect dates tested
34	echo "" \| tee -a reports/evidence_inventory.txt
35	echo "=== Test Dates ===" \| tee -a reports/evidence_inventory.txt
36	ls -la evidence/ 2>/dev/null \| grep "^d" \| awk '{print $9}' \| \
37	tee -a reports/evidence_inventory.txt
38	```
39
40	## Report Template Structure
41
42	The report-writer agent reads all evidence files and produces a professional pentest report. Below is the complete template:
43
44	## Full Report Template
45	```markdown
46	---
47	# PENETRATION TEST REPORT
48	## $ENGAGEMENT_NAME
49	### $TARGET_ORGANIZATION
50
51	---
52
53	Classification: CONFIDENTIAL — FOR AUTHORIZED RECIPIENTS ONLY
54	Report Date: $(date +%Y-%m-%d)
55	Testing Period: [START DATE] — [END DATE]
56	Report Version: 1.0
57
58	---
59
60	## Table of Contents
61	1. Executive Summary
62	2. Scope and Methodology
63	3. Risk Rating Criteria
64	4. Executive Findings Summary
65	5. Detailed Findings
66	6. Remediation Roadmap
67	7. Appendices
68
69	---
70
71	# 1. Executive Summary
72
73	## Risk Posture
74	[2-3 paragraph summary of overall security posture, business impact, and top 3 most critical issues]
75
76	Overall Risk Rating: [CRITICAL/HIGH/MEDIUM/LOW]
77
78	## Key Findings Overview
79	\| Severity \| Count \| Examples \|
80	\|----------\|-------\|---------\|
81	\| Critical \| X \| [e.g., RCE on perimeter web app] \|
82	\| High \| X \| [e.g., SQL injection, privilege escalation] \|
83	\| Medium \| X \| [e.g., outdated TLS, missing headers] \|
84	\| Low \| X \| [e.g., verbose error messages] \|
85	\| Informational \| X \| [e.g., asset discovery, technology stack] \|
86
87	## Top 3 Business-Critical Findings
88	1. [CRITICAL] [Finding Title]: [1-2 sentences on business impact and urgency]
89	2. [HIGH] [Finding Title]: [1-2 sentences on business impact and urgency]
90	3. [HIGH] [Finding Title]: [1-2 sentences on business impact and urgency]
91
92	---
93
94	# 2. Scope and Methodology
95
96	## Scope
97	\| Asset \| Type \| Testing Period \| Notes \|
98	\|-------\|------\|----------------\|-------\|
99	[from scope.txt]
100
101	## Engagement Type
102	- [ ] Black Box (no prior knowledge)
103	- [x] Grey Box (limited documentation provided)
104	- [ ] White Box (full access to source code and documentation)
105
106	## Methodology
107	This assessment followed industry-standard penetration testing methodology:
108	1. Reconnaissance: Passive OSINT, active scanning (nmap, nuclei, subfinder)
109	2. Enumeration: Service fingerprinting, web directory discovery, API enumeration
110	3. Exploitation: Vulnerability verification and controlled exploitation
111	4. Post-Exploitation: Privilege escalation, lateral movement (if in scope)
112	5. Reporting: Evidence collection, CVSS scoring, remediation guidance
113
114	## Tools Used
115	\| Tool \| Purpose \| Version \|
116	\|------\|---------\|---------\|
117	\| nmap \| Port scanning and service fingerprinting \| [version] \|
118	\| nuclei \| Vulnerability scanning \| [version] \|
119	\| Metasploit \| Exploitation framework \| [version] \|
120	\| Burp Suite \| Web application testing \| [version] \|
121	\| impacket \| Active Directory attacks \| [version] \|
122	\| hashcat \| Password cracking \| [version] \|
123	\| [others] \| \| \|
124
125	---
126
127	# 3. Risk Rating Criteria
128
129	## CVSS 3.1 Severity Mapping
130	\| CVSS Score \| Severity \| SLA \|
131	\|------------\|----------\|-----\|
132	\| 9.0 – 10.0 \| Critical \| 24 hours \|
133	\| 7.0 – 8.9 \| High \| 7 days \|
134	\| 4.0 – 6.9 \| Medium \| 30 days \|
135	\| 0.1 – 3.9 \| Low \| 90 days \|
136	\| 0.0 \| Informational \| Next release \|
137
138	## Risk Matrix
139	```
140	│ LOW

People who liked this also viewed

6 picks

Type

report-writer

60stars17forks

View on GitHub

How to install report-writer?

mukul975/threatswarm/report-writer

$curl -o .claude/agents/report-writer.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/report-writer.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/report-writer.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before writing any report, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:generating-threat-intelligence-reports`
5	- `cybersecurity-skills:building-incident-response-playbook`
6	- `cybersecurity-skills:building-incident-response-dashboard`
7	- `cybersecurity-skills:building-soc-playbook-for-ransomware`
8	- `cybersecurity-skills:implementing-diamond-model-analysis`
9
10	## Scope Enforcement
11	Read evidence/ directories only. Never include plaintext credentials in reports.
12	Verify scope.txt matches what was tested before writing scope section.
13	All credential references must use [REDACTED] in the report.
14
15	## Evidence Collection
16	```bash
17	# Gather all findings files from evidence directory
18	echo "=== Evidence Inventory ===" \| tee reports/evidence_inventory.txt
19
20	# Find all findings files
21	find evidence/ -name "findings" -o -name "report" -o -name "*.md" \
22	2>/dev/null \| sort \| tee -a reports/evidence_inventory.txt
23
24	# Count findings by severity
25	echo "" \| tee -a reports/evidence_inventory.txt
26	echo "=== Finding Counts ===" \| tee -a reports/evidence_inventory.txt
27
28	for sev in CRITICAL HIGH MEDIUM LOW INFO; do
29	count=$(grep -rh "$sev" evidence/*/findings*.md 2>/dev/null \| wc -l)
30	echo "$sev: $count" \| tee -a reports/evidence_inventory.txt
31	done
32
33	# Collect dates tested
34	echo "" \| tee -a reports/evidence_inventory.txt
35	echo "=== Test Dates ===" \| tee -a reports/evidence_inventory.txt
36	ls -la evidence/ 2>/dev/null \| grep "^d" \| awk '{print $9}' \| \
37	tee -a reports/evidence_inventory.txt
38	```
39
40	## Report Template Structure
41
42	The report-writer agent reads all evidence files and produces a professional pentest report. Below is the complete template:
43
44	## Full Report Template
45	```markdown
46	---
47	# PENETRATION TEST REPORT
48	## $ENGAGEMENT_NAME
49	### $TARGET_ORGANIZATION
50
51	---
52
53	Classification: CONFIDENTIAL — FOR AUTHORIZED RECIPIENTS ONLY
54	Report Date: $(date +%Y-%m-%d)
55	Testing Period: [START DATE] — [END DATE]
56	Report Version: 1.0
57
58	---
59
60	## Table of Contents
61	1. Executive Summary
62	2. Scope and Methodology
63	3. Risk Rating Criteria
64	4. Executive Findings Summary
65	5. Detailed Findings
66	6. Remediation Roadmap
67	7. Appendices
68
69	---
70
71	# 1. Executive Summary
72
73	## Risk Posture
74	[2-3 paragraph summary of overall security posture, business impact, and top 3 most critical issues]
75
76	Overall Risk Rating: [CRITICAL/HIGH/MEDIUM/LOW]
77
78	## Key Findings Overview
79	\| Severity \| Count \| Examples \|
80	\|----------\|-------\|---------\|
81	\| Critical \| X \| [e.g., RCE on perimeter web app] \|
82	\| High \| X \| [e.g., SQL injection, privilege escalation] \|
83	\| Medium \| X \| [e.g., outdated TLS, missing headers] \|
84	\| Low \| X \| [e.g., verbose error messages] \|
85	\| Informational \| X \| [e.g., asset discovery, technology stack] \|
86
87	## Top 3 Business-Critical Findings
88	1. [CRITICAL] [Finding Title]: [1-2 sentences on business impact and urgency]
89	2. [HIGH] [Finding Title]: [1-2 sentences on business impact and urgency]
90	3. [HIGH] [Finding Title]: [1-2 sentences on business impact and urgency]
91
92	---
93
94	# 2. Scope and Methodology
95
96	## Scope
97	\| Asset \| Type \| Testing Period \| Notes \|
98	\|-------\|------\|----------------\|-------\|
99	[from scope.txt]
100
101	## Engagement Type
102	- [ ] Black Box (no prior knowledge)
103	- [x] Grey Box (limited documentation provided)
104	- [ ] White Box (full access to source code and documentation)
105
106	## Methodology
107	This assessment followed industry-standard penetration testing methodology:
108	1. Reconnaissance: Passive OSINT, active scanning (nmap, nuclei, subfinder)
109	2. Enumeration: Service fingerprinting, web directory discovery, API enumeration
110	3. Exploitation: Vulnerability verification and controlled exploitation
111	4. Post-Exploitation: Privilege escalation, lateral movement (if in scope)
112	5. Reporting: Evidence collection, CVSS scoring, remediation guidance
113
114	## Tools Used
115	\| Tool \| Purpose \| Version \|
116	\|------\|---------\|---------\|
117	\| nmap \| Port scanning and service fingerprinting \| [version] \|
118	\| nuclei \| Vulnerability scanning \| [version] \|
119	\| Metasploit \| Exploitation framework \| [version] \|
120	\| Burp Suite \| Web application testing \| [version] \|
121	\| impacket \| Active Directory attacks \| [version] \|
122	\| hashcat \| Password cracking \| [version] \|
123	\| [others] \| \| \|
124
125	---
126
127	# 3. Risk Rating Criteria
128
129	## CVSS 3.1 Severity Mapping
130	\| CVSS Score \| Severity \| SLA \|
131	\|------------\|----------\|-----\|
132	\| 9.0 – 10.0 \| Critical \| 24 hours \|
133	\| 7.0 – 8.9 \| High \| 7 days \|
134	\| 4.0 – 6.9 \| Medium \| 30 days \|
135	\| 0.1 – 3.9 \| Low \| 90 days \|
136	\| 0.0 \| Informational \| Next release \|
137
138	## Risk Matrix
139	```
140	│ LOW

People who liked this also viewed

6 picks

Type