SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsdocs-generator

docs-generator

Security & auditing

View repository

Updated 10-16 09:28

About this skill

Bundled upstream support

Supporting files are included at skill-relative paths. See UPSTREAM-NOTICE.md for their pinned sources, licenses, hashes, and import changes.

Technical Documentation

When to Use

  • A finished analysis needs a structured, shareable report.
  • Standardizing write-ups across multiple cases.

Security/Reverse Engineering Task Document Output

After a reverse engineering/penetration testing/CTF/security analysis task is completed, this skill is responsible for generating a formal technical document in theuser's project directory.

Trigger Timing

  1. Reverse engineering task completed, with core conclusions produced (algorithm restoration, signature cracking, bypass solutions, etc.)
  2. Penetration testing completed, with vulnerabilities discovered and verified
  3. CTF challenge solved, with the flag obtained
  4. The user explicitly requests "write a report/document/writeup"

Template Selection

Task Type Template Used
APK/binary/so reverse engineering references/security-report-templates.md → Reverse Engineering Report
Penetration testing/vulnerability discovery references/security-report-templates.md → Penetration Testing Report
CTF solving references/security-report-templates.md → CTF Writeup
JS/Web signature reverse engineering references/security-report-templates.md → Signature Reverse Engineering Report
Malware / APT / virus analysis report references/security-report-templates.md + references/vendor-report-rules.md
General technical document references/templates.md → README / API documentation

Vendor Report Structure (Issue #65)

Security-related formal reports MUST read references/vendor-report-rules.md(only the structure is taken, the vendor's original text is not copied). Choose a vendor flavor only when the task evidence or the user explicitly requires it; for ordinary reverse engineering and other tasks use flavor = null。

Flavor / Overlay When to use Main reference skeleton
malware Clear malware samples, trojans, white-plus-black, phishing poisoning Huorong style: overview→flow→sample analysis→emergency response→IOC
apt APT/campaign/group/multi-stage infection chain/industry targeting Kaspersky Securelist style: summary→infection chain→investigation narrative→Interesting findings→technical analysis→detection and mitigation→IOC
flavor = null Ordinary APK/ELF/PE/Mach-O reverse engineering, algorithm/firmware analysis, penetration testing / CTF / JS signature Original task template + Base common elements; do not apply malware/APT-specific sections
thin vuln The user explicitly requests a vulnerability/patch/CVE technical analysis Overview→impact/reproduction→crash and patch analysis→protection recommendations (superimposed on null, not the 3rd default full-text flavor)

Principles:Templates should be refined rather than numerous —— only 2 vendor full-text flavors;vuln is only an optional thin overlay, and no third default full-text template is created. It takes effect simultaneously with §0 Evidence→Finding→Path simultaneously; in case of conflict, the Evidence contract takes precedence.

Output Specifications

  • Output location: the user's current project directory (not the skill package directory)
  • File name format：YYYY-MM-DD_[类型]-[目标简称]-report.md
  • If the project has a docs/ directory: prefer to place it under docs/ down
  • Encoding：UTF-8
  • Language: follow the user's conversation language (Chinese conversation produces a Chinese report, English conversation produces an English report)

Quality Requirements

  • All code blocks must be directly runnable or have clear context
  • There must be no placeholder/TODO
  • Key findings must be supported by evidence
  • Reproduction steps must allow a third party to independently reproduce them
  • Sensitive information (real tokens, passwords, internal URLs) should be replaced with placeholders
  • MUST includes the Evidence → Finding → Path chain (see ../ops/evidence-finding-path.md and template §0)
  • MUST Read references/vendor-report-rules.md: selected malware / apt or flavor = null(vulnerability tasks can stack thin vuln); with no flavor, output only the original task template and applicable Base elements, do not force IOC/ATT&CK
  • SHOULD Reference case scope.md / timeline.md（scripts/case-init.ps1）

case-init.ps1 writes scope.md, timeline.md, workitems.md, and README.md under work/<CaseName>/. It refuses to run when that case directory already exists; choose a new -CaseName to preserve prior case data.

Chart Integration

When generating a report, call the diagram-generator skill at appropriate points to generate visualization charts:

Report Type Recommended Chart Chart Type
Reverse Engineering Report Function call relationship diagram, data flow diagram Mermaid flowchart / sequenceDiagram
Penetration Testing Report Attack path diagram, network topology diagram Mermaid flowchart / Graphviz
CTF Writeup Solution approach flowchart Mermaid flowchart
JS Signature Reverse Engineering Report Request chain sequence diagram, algorithm flowchart Mermaid sequenceDiagram / flowchart

Charts are embedded in the report markdown as Mermaid code blocks to ensure they render directly on GitHub/GitLab.

Core Principles

1. Progressive Disclosure

Reveal information in layers:

Layer Content User Question
1 One-sentence description What is it?
2 Quick start code block How do I use it?
3 Full API reference What are my options?
4 Architecture deep dive How does it work?

Warnings, breaking changes, and prerequisites go at the TOP.

2. Task-Oriented Writing

<!-- Bad: Feature-oriented -->
## AuthService Class
The AuthService class provides authentication methods...

<!-- Good: Task-oriented -->
## Authenticating Users
To authenticate a user, call login() with credentials:

3. Show, Don't Tell

Every concept needs a concrete example.

Formatting Standards

  • Sentence case headings: "Getting started" not "Getting Started"
  • Max 3 heading levels: Deeper means split the doc
  • Always specify language in code blocks
  • Relative paths for internal links
  • Tables for structured data with 3+ attributes

Quality Checklist

  • Code examples tested and runnable
  • No placeholder text or TODOs
  • Matches actual code behavior
  • Scannable without reading everything
  • Reader knows what to do next

Anti-Patterns

Problem Fix
Wall of text Break up with headings, bullets, code, tables
Buried critical info Warnings/breaking changes at TOP
Missing error docs Always document what can go wrong

Templates

For README, API endpoint, and file organization templates, see references/templates.md.

Related Skills

  • Skill(ce:writer) - Writing style, tone, and voice (load The Engineer persona)
  • Skill(ce:visualizing-with-mermaid) - Architecture and flow diagrams

On-Demand Bootstrap

This skill does not depend on external tools and is pure text generation. No bootstrap needed.

If charts need to be rendered and embedded in the report, it will call diagram-generator/ skill。

Routing Context

Upstream Entry: All security/reverse engineering skills automatically call this skill after task completion Trigger Method:

  • Automatic: executed as step 9 of the behavior chain after task completion
  • Manual: user says "write report", "produce document", "writeup"

Peer Associated Modules:

  • apk-reverse/ — generate a reverse engineering report after APK reverse engineering is complete
  • ida-reverse/ — generate a reverse engineering report after binary analysis is complete
  • radare2/ — generate a reverse engineering report after CLI analysis is complete
  • js-reverse/ — generate a signature report after JS signature reverse engineering is complete
  • reverse-engineering/ — generate a reverse engineering report after general reverse engineering is complete
  • field-journal/ — report content also serves as the data source for the evolution log

Security Report Template: references/security-report-templates.md Vendor Report Rules: references/vendor-report-rules.md（flavor: malware | apt | null；optional overlay: vuln） General Document Template: references/templates.md

Task Completion Self-Check (MUST pass before claiming completion)

  • Did I execute every step in the workflow (rather than just reading it)?
  • Did I, based on tool-index , use real tool paths?
  • Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
  • Does the report contain Evidence / Finding / Path (ops contract)?
  • Have I completed and written back the Checklist items required by RULES?

Limitations

  • Report quality is bounded by the evidence captured during analysis.
  • Templates assume technical audiences; executive summaries need tailoring.

Adapted from zhaoxuya520/reverse-skill (MIT).