Guide · Agent skill
How to use the Pentest Report Writing agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-reporting skill is a set of written methodology files that an AI agent reads so it can help you write a penetration test or red team report. It covers how to structure the executive summary, lay out each technical finding, score issues with CVSS and handle evidence such as screenshots and credentials. This guide shows you how to install it, how to ask for help with natural requests, and what to watch for when you use it.
Pentest Report WritingSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the skill. Download the offensive-reporting ZIP from this page.
- 2Install it. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Gather your engagement material. Collect your findings, affected components, captured evidence and the audience for the deliverable before you ask for help.
- 4Ask in plain language. Describe the reporting task, such as structuring the executive summary or scoring a finding, and provide the facts.
- 5Review the draft in two passes. Check technical accuracy first, then read the report as a CISO would for clarity and business impact.
- 6Apply redaction and evidence rules. Replace credentials, hash extracted data, crop screenshots and remove metadata before anything leaves your secure environment.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file that gives an AI agent specific instructions for one kind of task. When the skill is installed, the agent can follow its methodology when a request matches the skill's description.
This skill covers reporting only. Once it is installed, the agent follows a structured approach to writing penetration test and red team reports. It helps organize a risk-led executive summary for non-technical leaders, lay out each technical finding with severity, reproduction steps, impact, remediation and retest notes, and score issues with CVSS v3.1 or v4.0 while justifying each metric. It also covers evidence handling such as redacting credentials, hashing client data and time-stamping actions.
- It is guidance for writing documents, not a tool that tests systems.
- It does not find or exploit vulnerabilities and includes no testing tools.
- It covers deliverable formats including PDF, DOCX, HTML and JSON for SIEM ingestion.
How do you install the offensive-reporting skill?
There are two ways to install it. Download the ZIP of the skill from this page, then either unzip it into your personal skills folder at ~/.claude/skills/ so it is available in all your projects, or unzip it into a project's .claude/skills/ folder so it is available only in that project.
If you use the Claude apps instead, upload the skill there under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the skill
~/.claude/skills/How do you trigger the skill with natural requests?
You do not need a special command. The skill is meant for use at the end of an engagement, when you are authoring a deliverable, restructuring a draft for executive readability, or setting up a reusable report template for a consulting practice. Describe what you need in plain words and mention the reporting task, and the agent can match your request to the skill.
Give the agent the details it needs to write well: the finding, the affected components, the evidence you captured and the audience. The skill's guidance expects you to supply facts; it does not supply the findings themselves.
- Help me structure the executive summary for our CISO from these findings.
- Score this SQL injection with CVSS v3.1 and justify each metric.
- Turn this draft finding into the standard technical finding format with a retest section.
- Set up a reusable pentest report template for our consulting team.
What does a good report look like with this skill?
The skill's standard structure starts with the executive summary, which is written last but read first. It is followed by an engagement overview covering scope, methodology, limitations and assumptions, then a risk summary, technical findings sorted by severity, attack narratives for chained findings, strategic recommendations, and appendices.
Each technical finding follows a template with an ID and title, severity, affected scope, status, CWE and OWASP references, a summary, description, reproduction steps, evidence, impact, remediation and notes for retest. The skill asks that every CVSS metric be justified in one sentence, for example noting why the attack vector is network-based or why no authentication is needed.
- Executive summary: engagement context, headline finding, risk verdict, severity counts and top three strategic recommendations.
- Finding remediation ordered as: fix the bug, add defense in depth, then add detection.
- Business impact adjustment paragraph when CVSS understates real-world risk.
How should you handle evidence and redaction?
The skill recommends logging every action with a UTC timestamp, source IP, target, action, result and a hash of any extracted data, so you can prove what you saw. Before any artifact leaves your secure environment, replace credentials with placeholders, hash extracted personal data, crop screenshots to the relevant area and check for leaked browser tabs or session tokens in URLs.
The skill also covers storage: an encrypted volume during the engagement, a per-engagement key, wiping to the client's specification at the end, and keeping only the report and a hash manifest of evidence.
- Redact credentials with placeholders such as <REDACTED-PASSWORD>.
- Never include real names, emails or SSNs in screenshots.
- Strip EXIF metadata from images before sharing.
- Keep the report and a hash manifest; delete other evidence on request.
exiftool -all= *.pngWhat are the safety notes and limits?
The skill has no scripts to run and makes no network calls. Its requirements list nothing beyond the skill itself. The exiftool line above is an example command from the methodology for you to run yourself on your own files; the skill does not run it for you.
The skill assumes a legitimate engagement with a defined scope. Do not use it to write reports about systems you are not authorized to assess. Treat any draft the agent produces as a starting point: check technical accuracy yourself, since the skill recommends a two-pass review, first for technical accuracy and then for narrative.
- Runs scripts: no
- Uses network: no
- Requires: nothing listed
- Only use it for systems covered by an authorized engagement.
What are the common report mistakes to avoid?
The skill names several mistakes that weaken reports. Over-CVSSing inflates severity and loses the reader's trust. Undermining the triager, meaning the developer or analyst who must act, makes the report harder to use. Missing the so-what leaves executives without a business consequence.
Use CVSS as a floor rather than a ceiling. If two reasonable people would score an issue differently, document why you chose your score.
- Avoid jargon such as payload, RCE, XSS, LDAP, SMB, Kerberos and injection in the executive summary.
- Anchor every finding to a business consequence such as customer data, regulatory exposure or operational disruption.
- Write reproduction steps a reader with no engagement context can follow in under 15 minutes.
What people use it for
- Structuring a one-page executive summary with a risk verdict and top three strategic recommendations for a non-technical board.
- Writing a technical finding with reproduction steps, impact, remediation and retest notes for a web application issue.
- Scoring findings with CVSS v3.1 or v4.0 and documenting the justification for each metric.
- Creating a reusable report template for a consulting practice, including a JSON or CSV index for a client's tracking system.
Frequently asked questions
Is the offensive-reporting skill free to use?
The source material for this page does not state pricing or licence terms beyond the licence listed for the item, which is MIT. Check the licence file in the skill's source before you rely on it commercially.
Does the skill find vulnerabilities or run security tests?
No. The skill covers reporting only and includes no testing tools. It helps you write up findings you have already established during an authorized engagement.
Where do I install the offensive-reporting skill?
Unzip the downloaded ZIP into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder for one project. In the Claude apps, upload it under Settings → Capabilities → Skills.
What do I need to run this skill?
The skill lists no requirements. It runs no scripts and uses no network. You need an agent environment that can load skills, and the findings and evidence you want written up.
Can I use this for CVSS v4.0 scoring?
Yes. The skill covers both CVSS v3.1 and v4.0. It notes that v4.0 adds environmental and threat metrics and is useful where a client requires it, while v3.1 remains the common default.
Is there an alternative if I want a different report format or tool?
The source does not name alternatives. The skill's own guidance includes OWASP's risk rating as an option for web-app-only engagements where CVSS feels stretched, and it lists PDF, DOCX, HTML and JSON as deliverable formats.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security consultants finishing a client engagement, teams standardizing a reusable report template, and students who want to learn how professional pentest reports are organized. It is not a testing tool, so use a separate method for finding vulnerabilities, and only use it for systems you are authorized to assess.
Download the skill