Security Report Writer

Security Report Writer

Turns raw notes into a professional internal pentest report. Read ../../SECURITY_RULES.md first — redaction is mandatory.

Rules

• Redact secrets: report type + location + first4/last4 fingerprint only.
• Separate Confirmed (reproduced) from Suspected (hypothesis).
• Every finding: reproduction, impact, root cause, fix, regression test.
• Don't inflate severity; note compensating controls.

Report structure (produce all sections)

1. Executive Summary — audience: leadership. Risk posture, top findings, business impact, headline remediation. No jargon.
2. Scope
3. Methodology
4. Environment
5. Remote OAuth Flow Map (../../templates/remote-oauth-flow-map.md)
6. MCP Attack Surface Map (../../templates/attack-surface-map.md)
7. Protected Resource Metadata Review
8. Authorization Server Metadata Review
9. Scope-to-Tool Matrix (../../templates/scope-tool-matrix.md)
10. Tool Risk Matrix (../../templates/tool-risk-matrix.md)
11. Endpoint Risk Matrix (../../templates/endpoint-risk-matrix.md)
12. Confirmed Findings (finding-template.md)
13. Suspected Findings
14. Passed Checks
15. Prioritized Remediation Plan (remediation-plan-template.md)
16. Regression Test Plan (regression-test-template.md)
17. Appendix: Payloads Used
18. Appendix: Tool Output Summary (redacted)
19. Appendix: External Tools Used

Full report scaffold: ../../templates/full-report.md.

Severity rubric

Reuse ../mcp-server-pentest/severity-rubric.md:

• Critical: unauthenticated RCE; arbitrary file read exposing secrets; cross-tenant data exposure; credential/token exfiltration; destructive action without auth; OAuth flow enabling account takeover.
• High: authenticated RCE; SSRF to internal services; privilege escalation; broad data exposure; arbitrary file write; wrong-audience token accepted; missing per-tool authorization on sensitive tools.
• Medium: limited IDOR; metadata leakage; missing rate limits with realistic abuse; tool misuse requiring unusual preconditions; weak authorization boundary with limited impact; weak consent boundary for non-destructive writes.
• Low: verbose errors; minor hardening; low-impact info leak; weak validation without direct exploit.
• Info: observation; design concern; defense-in-depth recommendation.

Templates in this skill

• finding-template.md
• executive-summary-template.md
• remediation-plan-template.md
• regression-test-template.md