pentest-report

Penetration Testing Report Generation Skill

Authorization Statement

This Skill is only used to generate reports for authorized penetration testing. Before use, ensure that:

• Testing has obtained explicit written authorization from the owner of the target system
• All vulnerability findings come from legally authorized testing activities
• The report is sent only to authorized personnel
• Local laws and regulations and data protection requirements are complied with

Unauthorized penetration testing is illegal.

---

Skill Purpose

Use this skill in the following situations:

• The user requests the generation of a penetration testing report
• The user requests output of security testing results
• The user needs to summarize vulnerability findings
• The user explicitly mentions "generate a report according to the format" or "according to the template"

---

Report Format Requirements

Required Sections

All reports must include the following sections, arranged in order:

1. Title and Project Information Table

   • Format:# 渗透测试报告：[目标系统名称/项目名称]
   • Includes a 4-field table: testing target, testing time, tester, report date

2. Vulnerability Summary

   • In table form, including columns: ID, vulnerability title, risk level, status
   • ID format: VL-001, VL-002, VL-003...
   • Risk level icons: 🔴Critical, 🟠High, 🟡Medium, 🔵Low, ⚪Info

3. Detailed Findings

   • Each vulnerability has its own independent section
   • Section title:### [VL-XXX] 漏洞标题
   • Must include 4 subsections:
     • #### 2.1 漏洞描述
     • #### 2.2 复现步骤 (Proof of Concept)
     • #### 2.3 证据截图
     • #### 2.4 修复建议

4. Appendix

   • ### 3.1 风险等级定义 - Risk level table
   • ### 3.2 CVSS 评分说明 - CVSS v3.1 explanation
   • ### 3.3 泄露凭证列表(if any)
   • ### 3.4 测试工具参考 - Tools table
   • ### 3.5 词汇表
   • ### 3.6 参考文档

5. Report Sign-off

   • Tester information
   • Disclaimer

Vulnerability Details Section Format

Each vulnerability section must begin with an attribute table:

| 属性 | 详情 |
| :--- | :--- |
| **风险等级** | 🔴 **严重 (Critical)** / 🟠 **高危 (High)** / 🟡 **中危 (Medium)** / 🔵 **低危 (Low)** |
| **CVSS 评分** | 0.0 - 10.0 |
| **漏洞类型** | [漏洞类型] |
| **受影响URL** | `[完整URL]` |
| **参数** | `[参数名]`（如有）|

Code Block Format

• HTTP requests use the http language identifier

POST /api/login HTTP/1.1
Host: example.com
Content-Type: application/json

{"username":"admin","password":"123456"}

• Bash commands use the bash language identifier

sqlmap -u "http://target.com" --dbs

• PHP code uses the php language identifier

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);

---

Workflow

Follow these steps when generating a penetration testing report:

Step 1: Collect Information

Obtain the following information from the user:

• Testing target (URL or system name)
• Testing date range
• Tester information
• List of discovered vulnerabilities
• Detailed information for each vulnerability (type, impact, evidence, PoC)

Step 2: Determine Vulnerability IDs

Assign an ID to each vulnerability:

• First vulnerability: VL-001
• Second vulnerability: VL-002
• And so on

Step 3: Assess Risk Levels

Determine the risk level based on the CVSS score:

CVSS Range	Risk Level	Icon
9.0 - 10.0	Critical	🔴
7.0 - 8.9	High	🟠
4.0 - 6.9	Medium	🟡
0.1 - 3.9	Low	🔵
0.0	Info	⚪

Step 4: Generate the report body

Generate in the following order：

1. Project Information Table - Fill in the 4 required fields

2. Vulnerability Findings List - Create a table containing summary information for all vulnerabilities

3. Vulnerability Details - Create a separate section for each vulnerability:

   • Attribute table (risk level, CVSS, type, URL, parameter)
   • 2.1 Vulnerability Description (2-3 paragraphs, explaining the principle, impact, and harm)
   • 2.2 Reproduction Steps (detailed steps, including HTTP requests and commands)
   • 2.3 Evidence Screenshots (placeholders or descriptions)
   • 2.4 Remediation Recommendations (including incorrect and correct code examples)

4. Appendix - Include all required subsections according to the template

Step 5: Validate the format

After generating the report, check:

• The title format is correct
• The project information table contains 4 fields
• The vulnerability findings list includes ID, title, risk level, and status
• Each vulnerability has an attribute table
• Each vulnerability has 4 subsections (2.1-2.4)
• The appendix includes all required subsections
• The risk levels use the correct icons
• Code blocks use the correct language identifiers

Step 6: Output the report

Save the generated report to the user's reports directory:

/Users/huimingliao/Documents/code/pentest-skills/reports/

File naming format:

pentest_report_[目标系统]_[日期].md

---

Important Notes

Format rules that must be followed

1. Table format: All tables must include a header separator row | :--- | :--- |
2. Risk level icons: The specified emoji icons must be used
3. Section numbering: Strictly follow the subsection numbering 2.1, 2.2, 2.3, 2.4
4. Code language: All code blocks must specify a language identifier
5. ID format: Vulnerability IDs must be in VL-XXX format, with 3 digits

Avoid common mistakes

❌ Do not omit the appendix section ❌ Do not mix different ways of representing risk levels ❌ Do not omit required fields in the attribute table ❌ Do not omit HTTP request examples in the reproduction steps ❌ Do not provide only textual explanations in the remediation recommendations (code examples must be included)

✅ Each vulnerability must include all 4 complete subsections ✅ Remediation recommendations must include code comparison (incorrect vs correct) ✅ All tables must have correct Markdown format ✅ A disclaimer must be included

---

Template Resource Locations

• Report Template：/Users/huimingliao/Documents/code/pentest-skills/templates/pentest_report_template.md
• Reference Report：/Users/huimingliao/Documents/code/pentest-skills/reports/pentest_report_localhost_9999_v2.md
• Report Directory：/Users/huimingliao/Documents/code/pentest-skills/reports/