# Report Writer

> Generate professional audit reports with structured findings, severity classifications, proof-of-concept code, and actionable recommendations. Use when writing individual findings, composing full audit reports, or formatting results for Code4rena, Sherlock, or client engagements.

- Skill: `0x-shashi/report-writer` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add 0x-shashi/report-writer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/0x-shashi/report-writer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: 0x-Shashi (https://skillmd.com/u/0x-shashi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/0x-shashi/report-writer

---


# Report Writer Skill

Generate professional audit reports with structured findings, severity classifications, proof-of-concept code, and actionable recommendations. Based on industry standards from Trail of Bits, OpenZeppelin, Cyfrin, Spearbit, and Code4rena.

---

## Report Components

| Component | Purpose | Length |
|-----------|---------|--------|
| Executive Summary | Non-technical overview for stakeholders | 1-2 paragraphs |
| Scope | Files/contracts reviewed, commit hash, exclusions | Table |
| Methodology | How the audit was conducted | 1 paragraph |
| Finding Summary | Table of all findings by severity | Table |
| Detailed Findings | Full write-up of each finding | Per finding |
| Centralization Risks | Admin/owner privilege analysis | Section |
| Gas Optimizations | Optional efficiency improvements | List |
| Appendix | Tools used, out-of-scope items | Section |

---

## Severity Classification

Based on the industry-standard Likelihood × Impact matrix:

| | Low Impact | Medium Impact | High Impact |
|---|---|---|---|
| **High Likelihood** | Medium | High | Critical |
| **Medium Likelihood** | Low | Medium | High |
| **Low Likelihood** | Info | Low | Medium |

### Likelihood Assessment

| Level | Criteria |
|-------|----------|
| High | Exploitable by anyone, no special conditions, low cost |
| Medium | Requires specific conditions, timing, or moderate skill |
| Low | Requires unlikely conditions, high cost, or privileged access |

### Impact Assessment

| Level | Criteria |
|-------|----------|
| High | Direct loss of funds, protocol takeover, permanent DoS |
| Medium | Conditional fund loss, temporary DoS, incorrect state |
| Low | Inconvenience, minor gas waste, edge case behavior |

---

## Finding ID Convention

| Prefix | Severity | Example |
|--------|----------|----------|
| C | Critical | C-01, C-02 |
| H | High | H-01, H-02 |
| M | Medium | M-01, M-02 |
| L | Low | L-01, L-02 |
| I | Informational | I-01, I-02 |
| G | Gas Optimization | G-01, G-02 |

---

## Writing Quality Standards

### Good Finding Characteristics

1. **Specific title** — Describes the vulnerability, not just the location
   - BAD: "Issue in withdraw function"
   - GOOD: "Missing reentrancy guard in withdraw() allows ETH drain via malicious token callback"

2. **Clear description** — A reader unfamiliar with the code can understand the issue

3. **Precise location** — Contract name, function, line numbers

4. **Demonstrated impact** — Concrete scenario showing what an attacker achieves

5. **Working PoC** — For Critical/High, a test case that proves exploitability

6. **Actionable fix** — Specific code change, not "fix the issue"

---

## Resources
- [Finding Templates](resources/finding-templates.md)
- [Report Template](resources/report-template.md)

## Workflows
- [Report Workflow](workflows/report-workflow.md)