offensive-reporting
帮助把技术发现转化为面向决策者的高质量交付物。
提供专业的渗透测试与红队报告撰写方法与结构化模板。
把渗透测试或红队的发现整理成能让客户、审计员和开发都能用的交付报告。适合在测试完成、要交付执行摘要、技术发现、复现步骤与修复建议时使用。特点是把非技术读者的风险叙事和技术细节分开，规范CVSS/OWASP打分、证据采集与脱敏，并能输出 PDF/DOCX/HTML/JSON 等格式，方便追踪和复测。
▸ 展开 SKILL.md 英文原文
Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.
帮我安装这个 skill：https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/utility/offensive-reporting/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/SnailSploit/Claude-Red/main/Skills/utility/offensive-reporting/SKILL.md"# Penetration Test Reporting — Professional Methodology A great finding lost in a bad report is a wasted finding. Reports are the artifact the client pays for, the auditor reads, and the developer fixes from. Treat the report with the same rigor as the exploit. ## Quick Workflow 1. Capture evidence as you exploit — never reconstruct after the fact 2. Draft each finding immediately while context is fresh; one finding = one numbered file 3. Build the executive summary last, after all findings are scored 4. Two-pass review: technical accuracy first, then read-as-CISO for narrative 5. Hand off with a retest plan and a JSON/CSV index for the client's tracking system --- ## Report Structure (