# Security Report Writer

> Turns raw pentest notes for a remote OAuth MCP system into a professional, internal security report with severity ratings, remediation, and regression tests. Produces executive summary, methodology, flow/attack-surface maps, matrices, confirmed vs suspected findings, passed checks, prioritized fixes, and a regression plan. Enforces safe redaction (secrets as type+location+ fingerprint). Use when converting findings into a deliverable report.

- Skill: `rwcod/security-report-writer` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add rwcod/security-report-writer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rwcod/security-report-writer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: rwcod (https://skillmd.com/u/rwcod)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rwcod/security-report-writer

---


# Security Report Writer

Turns raw notes into a professional internal pentest report. Read
[../../SECURITY_RULES.md](../../SECURITY_RULES.md) first — redaction is mandatory.

## Rules
- Redact secrets: report type + location + first4/last4 fingerprint only.
- Separate **Confirmed** (reproduced) from **Suspected** (hypothesis).
- Every finding: reproduction, impact, root cause, fix, regression test.
- Don't inflate severity; note compensating controls.

## Report structure (produce all sections)
1. **Executive Summary** — audience: leadership. Risk posture, top findings,
   business impact, headline remediation. No jargon.
2. **Scope**
3. **Methodology**
4. **Environment**
5. **Remote OAuth Flow Map** (`../../templates/remote-oauth-flow-map.md`)
6. **MCP Attack Surface Map** (`../../templates/attack-surface-map.md`)
7. **Protected Resource Metadata Review**
8. **Authorization Server Metadata Review**
9. **Scope-to-Tool Matrix** (`../../templates/scope-tool-matrix.md`)
10. **Tool Risk Matrix** (`../../templates/tool-risk-matrix.md`)
11. **Endpoint Risk Matrix** (`../../templates/endpoint-risk-matrix.md`)
12. **Confirmed Findings** (`finding-template.md`)
13. **Suspected Findings**
14. **Passed Checks**
15. **Prioritized Remediation Plan** (`remediation-plan-template.md`)
16. **Regression Test Plan** (`regression-test-template.md`)
17. **Appendix: Payloads Used**
18. **Appendix: Tool Output Summary** (redacted)
19. **Appendix: External Tools Used**

Full report scaffold: `../../templates/full-report.md`.

## Severity rubric
Reuse `../mcp-server-pentest/severity-rubric.md`:

- **Critical:** unauthenticated RCE; arbitrary file read exposing secrets;
  cross-tenant data exposure; credential/token exfiltration; destructive action
  without auth; OAuth flow enabling account takeover.
- **High:** authenticated RCE; SSRF to internal services; privilege escalation;
  broad data exposure; arbitrary file write; wrong-audience token accepted;
  missing per-tool authorization on sensitive tools.
- **Medium:** limited IDOR; metadata leakage; missing rate limits with realistic
  abuse; tool misuse requiring unusual preconditions; weak authorization
  boundary with limited impact; weak consent boundary for non-destructive writes.
- **Low:** verbose errors; minor hardening; low-impact info leak; weak
  validation without direct exploit.
- **Info:** observation; design concern; defense-in-depth recommendation.

## Templates in this skill
- `finding-template.md`
- `executive-summary-template.md`
- `remediation-plan-template.md`
- `regression-test-template.md`