skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

offensive-reporting

Writes penetration test and red team reports with CVSS scoring, evidence hygiene, and executive summaries.

Updated Sep 17, 2026
Search Tags:#security#vulnerability assessment#penetration testing#red team#report writing#cvss scoring#evidence management
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill offensive-reporting-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-reporting
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-reporting
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill offensive-reporting-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Penetration test findings lose value when reports are poorly structured, over-scored, or unreadable by executives. This Skill provides a complete methodology for authoring professional pentest and red team deliverables that clients can act on. ## Core Features & Use Cases - Structured Report Templates: Standard report skeleton covering executive summary, scope, risk summary, technical findings, attack chains, and strategic recommendations, plus a per-finding template with reproduction steps, impact, remediation, and retest notes. - Severity Scoring Discipline: CVSS v3.1/v4.0 vector justification, OWASP risk rating, and guidance on business impact adjustments when CVSS understates real risk. - Evidence Hygiene: Timestamped evidence logs, credential redaction rules, PII hashing, EXIF stripping, and chain-of-custody practices for engagement artifacts. - Use Case: At the end of a web app engagement, draft each finding as a numbered Markdown file with a justified CVSS vector, build a risk heatmap and attack-chain narrative, then generate PDF and JSON deliverables via Pandoc for the client and their SIEM. ## Quick Start Use the offensive-reporting skill to turn my engagement notes into a full penetration test report with an executive summary, scored findings, and a retest plan.

Frequently Asked Questions about offensive-reporting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a penetration test report executive summary?▼

Write the executive summary last, after all findings are scored, and keep it to one page. Include engagement context, the headline finding in business terms, an overall risk verdict, finding counts by severity, and three strategic recommendations, avoiding technical jargon like RCE or XSS.

How to score vulnerability severity with CVSS v3.1?▼

Build the full CVSS v3.1 vector and justify every metric choice in one sentence, such as AV:N for internet-exposed services. Treat CVSS as a floor rather than a verdict, and add a business impact adjustment paragraph when context makes the real risk higher than the score.

What should a technical finding include in a pentest report?▼

Each finding needs a title, severity with CVSS vector, affected scope, summary, root-cause description, numbered reproduction steps, evidence references, quantified impact, ordered remediation steps, references, and retest verification notes. A reader with no engagement context should reproduce it in under 15 minutes.

How do I handle evidence and screenshots in pentest reports?▼

Log every action with UTC timestamp, source IP, target, and result hash in an evidence CSV. Before delivery, redact credentials, hash extracted PII, crop screenshots, strip EXIF data with exiftool, and store artifacts on encrypted volumes with a defined retention period.

What is the difference between pentest reports and bug bounty reports?▼

Bug bounty reports target time-pressured triagers, so they need an 80-character title with bug class and impact, a single curl reproduction command, and impact anchored to the program's threat model. Full pentest reports add executive summaries, scope, limitations, and strategic recommendations.

When does CVSS scoring misrepresent real risk?▼

CVSS misses business context, so a medium-scored XSS in a support panel handling PII can outweigh a high-scored SSRF on an isolated service. Score CVSS honestly, then document a business impact adjustment arguing for higher reporting severity rather than inflating the vector.

Related Skills

Explore More Software Engineering Skills→
habrahgithubhabrahgithub

penetration-testing

Perform authorized penetration testing on applications, APIs, and network services.

Community
Advanced
bpcakesbpcakes
2

vulnerability-disclosure-and-retest-manager

Manage privacy-audit finding remediation, disclosure drafting, retest planning, and audit closure.

Official
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
brucesongsbrucesongs
60

pentest-reporting

Integrate Dradis and Faraday to unify evidence and findings into templated reports.

Community
Advanced