Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Pentest Report Writing: Findings a Client Will Act On

    1

    This skill makes your agent write both, from the notes you took during the test.

    $7.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Pentest Report Writing: Findings a Client Will Act On

    Pentest Report Writing: Findings a Client Will Act On

    Example session with this skill installed

    Write up an IDOR I found in NotesApp's orders API as a formal finding, with CVSS and remediation, ready for the client report.

    • Read your context and instructions
    • Compiled the pentest report writing

    Finding draft: IDOR in the orders API

    Status (example run): High severity, ready for technical review. One finding, two evidence requests, credentials redacted.

    Finding

    FieldValue
    TitleHorizontal IDOR exposes other users' orders
    SeverityHigh, CVSS v3.1 7.1
    VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
    AffectedGET /api/orders/{id}

    Narrative

    Authenticated as user A, changing {id} to a value owned by user B returns B's full order, including address and partial payment data. IDs are sequential, so enumeration is trivial.

    Reproduction

    1. Log in as a standard user, open your own order, and note the id.
    2. Decrement the id by one and replay the request.
    3. Observe another account's order in the response. Two requests were captured, tokens redacted.

    Impact and fix

    Any user can read every order in the system. Enforce an ownership check server-side on each object, not only in the UI. Retest status: Open.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    A strong engagement still fails if the report buries the risk, over-scores every finding, and reads like a scanner dump. The executive summary has to land with a CISO and the technical finding has to survive a triager. This skill makes your agent write both, from the notes you took during the test.

    What your agent does

    • Structures the executive summary: a risk-led narrative for a non-technical reader, written after the findings are scored.
    • Formats each finding: title, severity, affected scope, narrative, reproduction steps, impact, remediation and references.
    • Scores with justification: CVSS v3.1 and v4.0 with a defended vector, plus OWASP risk rating, and it warns against over-scoring.
    • Keeps evidence clean: redacts credentials, hashes client data, timestamps every action, and manages screenshots and PoC artifacts.
    • Tracks delivery and retest: client and customer deliverable separation, retest evidence and a JSON or CSV index for a tracker.

    Built-in guard rails

    • Drafts, does not deliver: it structures the report. You review, approve and send it to the client.
    • No client data retained: it prompts you to redact credentials and hash client data, and keeps nothing itself.
    • Honest scoring: it justifies every vector and flags over-scoring, which is how reports lose a triager's trust.

    What's inside

    One SKILL.md of about 2,200 words across 18 sections, covering executive summaries, finding format, CVSS scoring, evidence hygiene and deliverables, plus a LICENSE.txt.

    Works with Claude Code, Codex, Cursor, and any agent that loads SKILL.md.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    It drafts from the notes and evidence you give it; it cannot witness the engagement. Scoring still needs your judgment on environmental context. You own the final review and delivery to the client.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 day ago

    Software
    Claude Code
    orCodex
    orCursor
    Optional
    Your engagement notes and evidencea CVSS calculator

    Permissions

    Terminal / Shell
    Network Access
    Listed1 day ago

    What's inside

    Frequently Asked Questions

    No. It drafts and structures the report. You review, approve and deliver it to the client.

    No. It prompts you to redact credentials and hash client data, and keeps nothing itself.

    An agent that loads SKILL.md, plus your own engagement notes and evidence.

    No. It justifies every vector and warns against over-scoring, a common way to lose a triager's trust.

    New in Security