How to use the Technical Docs and Security Reports agent skill

What the skill makes the agent do

The skill covers two kinds of work. For general documentation, it asks the agent to write in progressive disclosure: a one-sentence description first, then a quick-start example, then the detailed reference, with warnings and prerequisites placed at the top. Its templates cover README files, API endpoint documentation and file organisation.

For security work, the skill tells the agent to write a report at the end of a completed task, saved in your project directory rather than in the skill folder. It chooses a template by task type: reverse engineering of APK, binary or .so files, penetration testing, CTF writeups, JavaScript signature reverse engineering, and malware or APT analysis. Reports are written in the language of the conversation, so a Chinese conversation gets a Chinese report.

• Output file names follow the pattern YYYY-MM-DD_[type]-[target]-report.md
• If the project has a docs/ folder, the report goes there first
• Diagrams are embedded as Mermaid code blocks so GitHub or GitLab can render them

Install the docs-generator skill

Download the ZIP for skills/docs-generator from the item page, then choose one of two routes. For a personal install that applies to all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. The unzipped skill folder should contain SKILL.md and a references/ folder with the templates.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

Trigger the skill with natural requests

You do not need a special command. The skill's description lists trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report and documentation. Ask for the outcome in plain language and mention the artefact you want. The skill also says it should run automatically at the end of a reverse engineering, penetration testing, CTF or security analysis task that has reached a core conclusion.

Be specific about the task type. The skill picks different templates for an APK reverse engineering job than for a CTF solve, so naming the task helps the agent choose the right one.

• Write a README for this project in English
• Write an API reference for the endpoints in this folder
• Write a writeup for the CTF challenge we just solved
• Write a report on the signature algorithm we reverse engineered
• Write a penetration test report for the findings we verified

What the output looks like

Documentation output follows the layers described above: a short summary, quick-start code, then reference material. Security reports must include an Evidence, Finding and Path chain, which the skill's security template describes as sections for scope, evidence items with reproduction commands, findings with confidence and status, and at least one path. The skill says reports must not contain placeholders or TODOs, and that sensitive values such as real tokens, passwords and internal URLs should be replaced with placeholders.

The skill is written so that a third party could reproduce the steps. Check that the reproduction commands actually run in your environment before you share the report.

What you need before you start

The skill itself is text instructions and templates. It runs no scripts and uses no network access. Its own instructions point to a tool index file and to companion skills (ce:writer, diagram-generator and an ops evidence-finding-path contract) that are not included in these files. The skill still works without them for writing, but style guidance and diagram generation depend on those companions being available in your setup.

For diagrams to render, you need a Mermaid-capable viewer such as GitHub or GitLab. Any Markdown viewer that does not support Mermaid will show the diagram source as plain code.

• An agent environment that supports skills (Claude Code project or user folder, or the Claude apps Skills setting)
• A Mermaid-capable viewer if you want diagrams rendered
• Optional companion skills for style and diagrams, which are not bundled here

Safety notes before you publish a report

The skill says the agent writes reports from its own findings, so claims must be checked by a person. Inaccurate or unverified findings can end up in a formal report that looks authoritative. Re-run key commands and confirm each finding against the evidence before the report leaves your machine.

Reports can also leak sensitive material. The skill asks for placeholders but cannot guarantee redaction. Review every code block, log excerpt and URL for real tokens, credentials and internal addresses. Do not use this skill for sensitive engagements without a manual review pass.

• Verify every finding and reproduction step yourself
• Search the report for tokens, passwords, internal URLs and evidence files before sharing
• Treat the output as a draft for a human reviewer

Tips for better results

Give the agent the facts it needs in the conversation: the target, the steps you took, and what you confirmed. The report is only as accurate as the findings it is built from. Ask for the language you want if it differs from the conversation language.

For vendor-style reports, the skill reads a rules file and chooses an optional structure. It says ordinary reverse engineering, penetration and CTF work should keep the task template rather than being forced into a malware-report format.

• State what you confirmed versus what you suspect
• Name the task type so the right template is chosen
• Ask for a Mermaid diagram of the attack path or call flow when a visual helps