vulnerability-writeup

Write source-backed vulnerability disclosure reports with PoCs from notes, findings, and scan output.

Updated May 4, 2026
One-click install
npx skills add https://github.com/antstanley/skills --skill vulnerability-writeup-antstanley
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: vulnerability-writeup
Source: https://github.com/antstanley/skills/tree/main/plugins/security/skills/vulnerability-writeup
Command: npx skills add https://github.com/antstanley/skills --skill vulnerability-writeup-antstanley

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Turning rough vulnerability notes, scanner findings, and PoC fragments into polished, self-contained disclosure reports is slow and inconsistent. This Skill runs a structured campaign that produces one expert-quality, source-backed report per vulnerability, complete with a runnable proof of concept. ## Core Features & Use Cases - One sub-agent per vulnerability: Deduplicates findings by root cause, then delegates each bug to a dedicated worker for focused, high-depth write-ups. - Source-proven analysis: Traces each bug from attacker-controlled entry point through state transitions to the bad state, quoting the vulnerable revision and fix diffs. - First-class PoC deliverables: Ships each report with a poc/ directory containing build files, run commands, representative output, and safety notes. - Use Case: Given a folder of rough kernel bug notes and a target source tree, produce a distributable report set where each vulnerability gets its own directory, narrative markdown report, exploitability analysis, and verified PoC. ## Quick Start Use the vulnerability-writeup skill to turn my rough notes and PoC in this folder into a polished disclosure report against the target source tree.

Frequently Asked Questions about vulnerability-writeup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a vulnerability disclosure report from rough notes?

Provide the raw notes, PoC artifacts, and the target source tree with the vulnerable revision. The skill inventories and deduplicates findings, then delegates each vulnerability to a dedicated sub-agent that writes a source-backed report following the report-format reference.

How to write a security report without a scanner or scan output?

A security scan is optional. Ordinary disclosure documents, supplied findings, and PoCs are first-class inputs; the skill inventories them directly and applies the same research and quality bar as scan-driven workflows.

What sections does a vulnerability report need?

The required structure is Executive Summary, Background, Vulnerability Details, Exploitability Analysis, Proof of Concept, Remediation, and Summary. Each report must prove the bug from source and ship with a runnable PoC directory.

Can I run PoCs against live production targets?

No. Testing against public or live production instances is forbidden unless the user explicitly authorizes that target. The skill prefers disposable VMs or local test targets for crashes, corruption, or privilege escalation PoCs.

What happens if source code access is missing?

Source access is mandatory for an excellent report. The workflow stops and requests the source tree or vulnerable revision unless the user explicitly accepts a lower-confidence report based on the available material.