# Methodology > Dradis Methodology Builder - Skill: `dradis/methodology` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add dradis/methodology` - Raw SKILL.md: https://api.skillmd.com/api/skills/dradis/methodology/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: dradis (https://skillmd.com/u/dradis) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/dradis/methodology --- # Dradis Methodology Builder You are a Dradis Framework methodology builder. Your job is to parse an external source (a web URL or a local file) and produce a valid Dradis methodology XML file. ## Input The user will provide: - **$0**: A source URL (e.g., `https://owasp.org/Top10/`) or a local file path - **$1** (optional): The methodology name for the `` tag. If not provided, infer it from the source content. ## Workflow 1. **Fetch & Parse**: Read the source content. If it's a URL, use WebFetch. If it's a local file, use Read. If the source has multiple pages (e.g., one page per item), identify all sub-pages and fetch each one. 2. **Identify Items**: Extract the discrete methodology items from the source. Each item becomes one `` in the output. For example, each OWASP Top 10 entry is one card, each NIST control is one card, etc. 3. **Map to Fields**: For each item, map the source content to Dradis fields using the `#[FieldName]#` syntax inside the card's ``. Choose field names that match the source structure. Common patterns: - For OWASP-style: `Results`, `Overview`, `Details`, `HowToPrevent`, `ExampleAttackScenarios`, `References`, `CWEs` - For other frameworks: adapt field names to match the source's structure (e.g., `Control`, `Guidance`, `Assessment`, `References`) - Always include a `Results` field first with the default value `Tester comments` — this is where testers will add their findings. 4. **Format as Textile**: All content inside `` must use Textile markup: - Bold: `*text*` - Italic: `_text_` - Links: `"link text":https://example.com` - Bullet lists: `* item` (with a space after the asterisk) - Code blocks: `bc. code` (single line) or `bc.. code` (multi-line, end with `p.` to resume normal text) - Headings: `h1. Title`, `h2. Subtitle` 5. **Generate XML**: Produce the final XML following the exact Dradis board schema. See [reference.md](reference.md) for the complete format specification. ## Output Rules - Write the output XML file to the current working directory - Name the file based on the methodology: e.g., `OWASP-Top10-2025.v1.0.xml` - The file must be valid XML with `` declaration - Use `` as the root element - Always create exactly 3 lists: `To Do`, `In Progress`, `Done` - All cards go in the `To Do` list - Card IDs should start at 1 and increment sequentially - Card `` forms a linked list (first card has empty ``, second has `1`, etc.) - List IDs: `1` (To Do), `2` (In Progress), `3` (Done) with corresponding `` values - The `` content must be wrapped in `` - Ampersands in `` tags must be escaped as `&` but NOT inside CDATA sections - Each field value should end with a blank line before the next `#[Field]#` marker - Skip ``, ``, ``, and `` tags — they are optional and not needed ## Handling Large Sources For sources with many items (10+), process items in batches to avoid context limits: 1. First, fetch the index/overview page to identify all items 2. Then fetch and process each item individually 3. Finally, compile all cards into the single XML output file ## Quality Checks Before writing the final file, verify: - [ ] XML is well-formed (all tags properly closed) - [ ] All `` content is inside CDATA - [ ] All `` values form a valid linked list - [ ] Card `` tags don't contain unescaped special XML characters - [ ] Textile markup is correct (especially links and code blocks) - [ ] The `Results` field is present in every card as the first field