# Finding Report

> Generate a structured pentest finding report in markdown. Use when documenting a vulnerability, writing up a finding, or creating engagement notes.

- Skill: `specterops/finding-report` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add specterops/finding-report`
- Raw SKILL.md: https://api.skillmd.com/api/skills/specterops/finding-report/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: specterops (https://skillmd.com/u/specterops)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/specterops/finding-report

---


# Pentest Finding Report

Generate a structured markdown finding report suitable for inclusion in a professional penetration test report.

Parse the user's input to determine the finding title and severity:
- `$finding-report "Kerberoastable Service Account with Path to DA"` → create finding with default High severity
- `$finding-report "Open S3 Bucket" --severity critical` → create finding with specified severity
- `$finding-report` → ask for a title

## Steps

1. Create the output directory if it doesn't exist (`mkdir -p findings/`) and create a new file at `findings/<title-slugified>.md` (convert title to kebab-case)

2. Use this template structure:

```markdown
# [Title]

| Field | Value |
|---|---|
| **Severity** | [Critical/High/Medium/Low/Info] |
| **CVSS 3.1** | [Score] ([Vector String]) |
| **CWE** | [CWE-ID: Name] |
| **Affected Asset(s)** | [hosts, URLs, or services] |
| **Status** | Open |

## Description

[2-3 sentences explaining what the vulnerability is and where it exists. Be specific about the affected component.]

## Impact

[What can an attacker achieve by exploiting this? Be concrete — data exposure, lateral movement, privilege escalation, etc.]

## Evidence

[Screenshots, command output, or proof. Use fenced code blocks for command output.]

```
[command or request used]
```

```
[response or output showing the vulnerability]
```

## Reproduction Steps

1. [Step-by-step instructions to reproduce]
2. [Be specific enough that another tester could verify]
3. [Include exact commands, URLs, parameters]

## Remediation

**Short-term**: [Immediate mitigation]

**Long-term**: [Root cause fix]

## References

- [Relevant CVE, blog post, or documentation]
```

3. Fill in the template based on the information provided. If information is missing, insert `[TODO: ...]` placeholders

4. For CVSS scoring, calculate based on the described impact:
   - Network-accessible + no auth + high impact = Critical (9.0+)
   - Requires auth or local access + high impact = High (7.0-8.9)
   - Limited impact or requires chaining = Medium (4.0-6.9)
   - Minor information disclosure = Low (0.1-3.9)

5. Map to appropriate CWE IDs (common ones):
   - SQL Injection: CWE-89
   - XSS: CWE-79
   - Command Injection: CWE-78
   - Path Traversal: CWE-22
   - SSRF: CWE-918
   - Broken Auth: CWE-287
   - IDOR: CWE-639
   - Weak Crypto: CWE-327
   - Kerberoasting: CWE-916
   - ACL Misconfiguration: CWE-732
   - Certificate Template Abuse: CWE-295

6. Report the file path back to the user