How do I install the Pentest Report skill?

Run npx skillmds@latest add rifteo/pentest-report in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pentest Report safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pentest Report?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pentest Report free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published Pentest Report?

Rifteo (@rifteo) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pentest Report by rifteo — Agent Skill

Name: Pentest Report
Rating: 4.2 (5 reviews)
Author: Rifteo

Pentest Report

Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending to the client.

Rifteo Updated Sep 22, 2026

File contents

Pentest Report Generator

Turn all findings from a testing engagement into a single, client-ready penetration test report. Auditors spend 30-40% of engagement time on reporting. This skill handles the structure, ordering, and framing — you provide the findings.

What You Need Before Starting

Confirmed findings (from finding-writer)
Engagement scope and target (from ENGAGEMENT.md or scope-grill output)
Test dates and tester names (ask if not available)

Report Structure

Generate each section in order. See references/report-template.md for the full template.

1. Cover Page

Client name, engagement title, date range, classification (Confidential), prepared by.

2. Executive Summary

3-5 paragraphs. Written for a non-technical audience (C-suite, board).

What was tested and why
Overall risk posture in plain language
The single most critical finding, in business terms
Top 3 recommended actions

Do not use technical jargon. Do not list every finding. See references/exec-summary-guide.md.

3. Scope and Methodology

In-scope targets (from ENGAGEMENT.md)
Out-of-scope items
Test type (black/grey/white box)
Test dates
Tools and techniques used (high level)
Limitations and caveats

4. Risk Summary Table

#	Title	Severity	Component	Status
F-01	SQL Injection in /api/search	Critical	API	Confirmed

Order by severity (Critical → High → Medium → Low → Info).

5. Technical Findings

One section per finding, in the same order as the risk table. Each finding uses the full finding-writer format: Title, Severity, CVSS, Description, Evidence, Impact, Recommendation, References.

6. Recommendations Summary

Ordered action list — immediate (Critical/High) first, then Medium, then hardening. Cross-reference finding IDs (F-01, F-02...).

7. Appendices (if applicable)

Full tool output
Scope confirmation letter reference
Methodology references

Rules

The executive summary must be understandable by someone with no security background
Never include unconfirmed findings — mark suspected issues as "Out of Scope" or "Requires Further Testing"
Every finding in the report must have a corresponding ID in the risk table
Do not pad with generic security advice unrelated to the engagement
Ask for test dates and tester name if ENGAGEMENT.md is missing

---name: pentest-reportdescription: Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending to the client.license: MIT---# Pentest Report GeneratorTurn all findings from a testing engagement into a single, client-ready penetration test report. Auditors spend 30-40% of engagement time on reporting. This skill handles the structure, ordering, and framing — you provide the findings.## What You Need Before Starting- Confirmed findings (from `finding-writer`)- Engagement scope and target (from `ENGAGEMENT.md` or `scope-grill` output)- Test dates and tester names (ask if not available)## Report StructureGenerate each section in order. See `references/report-template.md` for the full template.### 1. Cover PageClient name, engagement title, date range, classification (Confidential), prepared by.### 2. Executive Summary3-5 paragraphs. Written for a non-technical audience (C-suite, board).- What was tested and why- Overall risk posture in plain language- The single most critical finding, in business terms- Top 3 recommended actionsDo not use technical jargon. Do not list every finding. See `references/exec-summary-guide.md`.### 3. Scope and Methodology- In-scope targets (from ENGAGEMENT.md)- Out-of-scope items- Test type (black/grey/white box)- Test dates- Tools and techniques used (high level)- Limitations and caveats### 4. Risk Summary Table| # | Title | Severity | Component | Status ||---|---|---|---|---|| F-01 | SQL Injection in /api/search | Critical | API | Confirmed |Order by severity (Critical → High → Medium → Low → Info).### 5. Technical FindingsOne section per finding, in the same order as the risk table. Each finding uses the full `finding-writer` format:Title, Severity, CVSS, Description, Evidence, Impact, Recommendation, References.### 6. Recommendations SummaryOrdered action list — immediate (Critical/High) first, then Medium, then hardening.Cross-reference finding IDs (F-01, F-02...).### 7. Appendices (if applicable)- Full tool output- Scope confirmation letter reference- Methodology references## Rules- The executive summary must be understandable by someone with no security background- Never include unconfirmed findings — mark suspected issues as "Out of Scope" or "Requires Further Testing"- Every finding in the report must have a corresponding ID in the risk table- Do not pad with generic security advice unrelated to the engagement- Ask for test dates and tester name if ENGAGEMENT.md is missing

Frequently asked questions