generate-test-leads

You can prioritize security testing leads by running this skill after Semgrep, secret scanning, and AI security reviews to transform raw findings into actionable, ranked test steps. It computes CVSSv4 scores and attaches file context, CWE, and recommended tests to each lead.

Converting static analysis and endpoint enumeration outputs into actionable pentest targets is done by processing those results to generate prioritized leads. Each lead is annotated with source context, CWE, and clear testing steps to guide focused security testing.

Yes, calculating CVSSv4 scores for security findings is supported via the cvss-scorer dependency. It attaches the calculator URL and score to each generated testing lead to help prioritize vulnerability validation.

Publishing prioritized security test leads directly to Confluence is supported using MCP tools. This allows teams to share annotated findings, testing steps, and vulnerability context directly within their documentation workspace.

Yes, you need to run SAST triage, Semgrep, secret scanning, and AI security reviews before generating security test leads. This skill processes those upstream outputs to compute prioritized targets and reproduceable testing steps.

Security testing leads generated from static analysis are annotated with the finding source, file context, CWE, CVSSv4 scores, and recommended tests. This provides pentesters with the necessary context to reproduce and validate vulnerabilities.