How do I install the Finding Report skill?

Run npx skillmds@latest add specterops/finding-report in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Finding Report safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Finding Report?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Finding Report free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Finding Report?

specterops (@specterops) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Finding Report by specterops — Agent Skill

Name: Finding Report
Author: specterops

File contents

Pentest Finding Report

Generate a structured markdown finding report suitable for inclusion in a professional penetration test report.

Parse the user's input to determine the finding title and severity:

$finding-report "Kerberoastable Service Account with Path to DA" → create finding with default High severity
$finding-report "Open S3 Bucket" --severity critical → create finding with specified severity
$finding-report → ask for a title

Steps

Create the output directory if it doesn't exist (mkdir -p findings/) and create a new file at findings/<title-slugified>.md (convert title to kebab-case)
Use this template structure:

# [Title]

| Field | Value |
|---|---|
| **Severity** | [Critical/High/Medium/Low/Info] |
| **CVSS 3.1** | [Score] ([Vector String]) |
| **CWE** | [CWE-ID: Name] |
| **Affected Asset(s)** | [hosts, URLs, or services] |
| **Status** | Open |

## Description

[2-3 sentences explaining what the vulnerability is and where it exists. Be specific about the affected component.]

## Impact

[What can an attacker achieve by exploiting this? Be concrete — data exposure, lateral movement, privilege escalation, etc.]

## Evidence

[Screenshots, command output, or proof. Use fenced code blocks for command output.]

[command or request used]

[response or output showing the vulnerability]


## Reproduction Steps

1. [Step-by-step instructions to reproduce]
2. [Be specific enough that another tester could verify]
3. [Include exact commands, URLs, parameters]

## Remediation

**Short-term**: [Immediate mitigation]

**Long-term**: [Root cause fix]

## References

- [Relevant CVE, blog post, or documentation]

Fill in the template based on the information provided. If information is missing, insert [TODO: ...] placeholders
For CVSS scoring, calculate based on the described impact:
- Network-accessible + no auth + high impact = Critical (9.0+)
- Requires auth or local access + high impact = High (7.0-8.9)
- Limited impact or requires chaining = Medium (4.0-6.9)
- Minor information disclosure = Low (0.1-3.9)
Map to appropriate CWE IDs (common ones):
- SQL Injection: CWE-89
- XSS: CWE-79
- Command Injection: CWE-78
- Path Traversal: CWE-22
- SSRF: CWE-918
- Broken Auth: CWE-287
- IDOR: CWE-639
- Weak Crypto: CWE-327
- Kerberoasting: CWE-916
- ACL Misconfiguration: CWE-732
- Certificate Template Abuse: CWE-295
Report the file path back to the user

---name: finding-reportdescription: Generate a structured pentest finding report in markdown. Use when documenting a vulnerability, writing up a finding, or creating engagement notes.---# Pentest Finding ReportGenerate a structured markdown finding report suitable for inclusion in a professional penetration test report.Parse the user's input to determine the finding title and severity:- `$finding-report "Kerberoastable Service Account with Path to DA"` → create finding with default High severity- `$finding-report "Open S3 Bucket" --severity critical` → create finding with specified severity- `$finding-report` → ask for a title## Steps1. Create the output directory if it doesn't exist (`mkdir -p findings/`) and create a new file at `findings/<title-slugified>.md` (convert title to kebab-case)2. Use this template structure:```markdown# [Title]| Field | Value ||---|---|| **Severity** | [Critical/High/Medium/Low/Info] || **CVSS 3.1** | [Score] ([Vector String]) || **CWE** | [CWE-ID: Name] || **Affected Asset(s)** | [hosts, URLs, or services] || **Status** | Open |## Description[2-3 sentences explaining what the vulnerability is and where it exists. Be specific about the affected component.]## Impact[What can an attacker achieve by exploiting this? Be concrete — data exposure, lateral movement, privilege escalation, etc.]## Evidence[Screenshots, command output, or proof. Use fenced code blocks for command output.]```[command or request used]``````[response or output showing the vulnerability]```## Reproduction Steps1. [Step-by-step instructions to reproduce]2. [Be specific enough that another tester could verify]3. [Include exact commands, URLs, parameters]## Remediation**Short-term**: [Immediate mitigation]**Long-term**: [Root cause fix]## References- [Relevant CVE, blog post, or documentation]```3. Fill in the template based on the information provided. If information is missing, insert `[TODO: ...]` placeholders4. For CVSS scoring, calculate based on the described impact: - Network-accessible + no auth + high impact = Critical (9.0+) - Requires auth or local access + high impact = High (7.0-8.9) - Limited impact or requires chaining = Medium (4.0-6.9) - Minor information disclosure = Low (0.1-3.9)5. Map to appropriate CWE IDs (common ones): - SQL Injection: CWE-89 - XSS: CWE-79 - Command Injection: CWE-78 - Path Traversal: CWE-22 - SSRF: CWE-918 - Broken Auth: CWE-287 - IDOR: CWE-639 - Weak Crypto: CWE-327 - Kerberoasting: CWE-916 - ACL Misconfiguration: CWE-732 - Certificate Template Abuse: CWE-2956. Report the file path back to the user

Frequently asked questions

Finding Report