Phase 8: Report Generation

Phase 8: Report Generation

Type: Comprehensive Executor: LLM Knowledge: Compliance Frameworks, ASVS

⚠️ MANDATORY: 4-Phase Gating Protocol (BLOCKING)

CRITICAL: 必须按顺序完成以下四个阶段。跳过任何阶段将导致分析质量下降！

① THINKING (理解阶段) - 在任何规划前完成

Purpose: 聚合所有P1-P7数据，生成完整报告，不截断不总结。

在开始P8分析前，必须明确回答以下问题：

thinking_checkpoint:
  core_problem: "合成8份报告，必须完整包含P6 POC和P7缓解措施代码"
  what_i_know:
    - "P1模块/入口点数: [从P1 YAML读取]"
    - "P2 DFD元素数: [从P2 YAML读取]"
    - "P3边界数: [从P3 YAML读取]"
    - "P4 Gap数: [从P4 YAML读取]"
    - "P5威胁数: [从P5 YAML读取]"
    - "P6 VR数: [从P6 YAML读取]"
    - "P6 POC数: [从P6 YAML读取 poc_details 长度]"
    - "P6 AC数: [从P6 YAML读取 attack_chains 长度]"
    - "P7 MIT数: [从P7 YAML读取 mitigations 长度]"
  what_i_dont_know:
    - "[合规框架映射细节]"
  what_could_go_wrong:
    - "8份报告未全部生成"
    - "P6 POC被截断或总结"
    - "P7缓解代码被省略"
    - "攻击链图缺失"

⛔ STOP条件: 如果任何Phase数据未从YAML读取 → 先读取所有Phase数据再继续

② PLANNING (规划阶段) - 理解确认后

Purpose: 分解为可验证的子任务，确保8份报告完整生成。

Step 1: 读取ALL P1-P7数据 (BLOCKING - 必须执行)

# 读取所有Phase YAML
cat .phase_working/{SESSION_ID}/data/P1_project_context.yaml
cat .phase_working/{SESSION_ID}/data/P2_dfd_elements.yaml
cat .phase_working/{SESSION_ID}/data/P3_boundary_context.yaml
cat .phase_working/{SESSION_ID}/data/P4_security_gaps.yaml
cat .phase_working/{SESSION_ID}/data/P5_threat_inventory.yaml
cat .phase_working/{SESSION_ID}/data/P6_validated_risks.yaml
cat .phase_working/{SESSION_ID}/data/P7_mitigation_plan.yaml

⛔ 如果任何上游YAML不存在或无效 → STOP并返回完成上游Phase

Step 2: 分解子任务 (建议3-7个)

- T1: 读取全部P1-P7 YAML数据
- T2: 生成主报告 {PROJECT}-RISK-ASSESSMENT-REPORT.md (9节)
- T3: 生成RISK-INVENTORY.md (P6完整内容)
- T4: 生成MITIGATION-MEASURES.md (P7完整代码)
- T5: 生成PENETRATION-TEST-PLAN.md (POC→TC映射)
- T6: 生成其他4份报告 (ARCHITECTURE, DFD, COMPLIANCE, ATTACK-PATH)
- T7: 复制Phase报告，写入P8_report_manifest.yaml

Step 3: TaskCreate for ALL sub-tasks (MANDATORY)

⚠️ 在开始任何实施前，TaskList必须显示所有子任务！

③ EXECUTION LOOP (执行阶段)

For each sub-task:

1. TaskUpdate(status: "in_progress")
2. 实施子任务
3. 验证: 输出是否符合预期？
4. If 验证通过: TaskUpdate(status: "completed") → 下一个
5. If 验证失败: 诊断 → 修复 → 重试 (max 3x) → 如仍失败: CHECKPOINT请求用户决策

输出顺序 (CRITICAL):

1. 先写YAML: .phase_working/{SESSION_ID}/data/P8_report_manifest.yaml
2. 再写8份报告: Risk_Assessment_Report/{PROJECT}-*.md
3. 复制Phase报告: .phase_working/{SESSION_ID}/reports/P*-*.md → Risk_Assessment_Report/

禁止行为:

• ❌ "See P6 for details"
• ❌ "Top 3 risks shown, others omitted"
• ❌ 总结POC代码
• ❌ 截断攻击链

④ REFLECTION (反思阶段) - 完成前必须确认

Before marking Phase 8 complete, verify ALL:

• ALL P1-P7 YAML数据已读取？
• P8_report_manifest.yaml 存在且有效？
• 8份报告全部生成在Risk_Assessment_Report/？
  • {PROJECT}-RISK-ASSESSMENT-REPORT.md (主报告9节)
  • {PROJECT}-RISK-INVENTORY.md
  • {PROJECT}-MITIGATION-MEASURES.md
  • {PROJECT}-PENETRATION-TEST-PLAN.md
  • {PROJECT}-ARCHITECTURE-ANALYSIS.md
  • {PROJECT}-DFD-DIAGRAM.md
  • {PROJECT}-COMPLIANCE-REPORT.md
  • {PROJECT}-ATTACK-PATH-VALIDATION.md
• 主报告§5包含完整P6 POC代码？
• 主报告§6包含完整攻击链ASCII图？
• 主报告§8包含完整P7缓解代码？
• Phase报告已复制到报告目录？
• Hook验证通过 (exit 0)？

⛔ 任何检查失败 → 修复并重新验证，直到全部通过

⚠️ MANDATORY OUTPUT RULES

CRITICAL: Phase 8 requires 8 mandatory reports output to Risk_Assessment_Report/ directory.

Output Validation

Phase 8 CANNOT complete until:

1. All 8 mandatory reports exist in Risk_Assessment_Report/
2. Main report contains all 9 sections with complete content
3. P6 POCs and attack chains included verbatim (not summarized)
4. P7 mitigations included with full code examples
5. All phase outputs published to report directory

Error Handling

Fallback Strategy: If a specific phase YAML cannot be parsed, use the corresponding phase MD report as secondary source. Mark affected sections with [Source: MD Report - verify against YAML].

Input Context

← P1-P7: ALL preceding phase outputs

CRITICAL: Phase 8 MUST read all phase files and aggregate content completely - do NOT summarize from memory!

Required Input Files:

.phase_working/{SESSION_ID}/data/P1_project_context.yaml
.phase_working/{SESSION_ID}/data/P2_dfd_elements.yaml
.phase_working/{SESSION_ID}/data/P3_boundary_context.yaml
.phase_working/{SESSION_ID}/data/P4_security_gaps.yaml
.phase_working/{SESSION_ID}/data/P5_threat_inventory.yaml
.phase_working/{SESSION_ID}/data/P6_validated_risks.yaml
.phase_working/{SESSION_ID}/data/P7_mitigation_plan.yaml

Output Context

→ Final Reports: 8 mandatory reports + phase outputs

Primary Output: P8_report_manifest.yaml

# P8_report_manifest.yaml Schema Definition
session_id: "{SESSION_ID}"
timestamp: "ISO8601"
version: "3.0.0 (20260201a)"

generation_summary:
  total_reports: 8
  generated_reports:
    - name: "{PROJECT}-RISK-ASSESSMENT-REPORT.md"
      type: main_synthesis
      status: generated | failed
      sections_count: 9
    - name: "{PROJECT}-RISK-INVENTORY.md"
      type: risk_inventory
      source: P6
      status: generated
    - name: "{PROJECT}-MITIGATION-MEASURES.md"
      type: mitigations
      source: P7
      status: generated
    - name: "{PROJECT}-PENETRATION-TEST-PLAN.md"
      type: pentest_plan
      source: P6
      status: generated
    - name: "{PROJECT}-ARCHITECTURE-ANALYSIS.md"
      type: architecture
      source: P1-P3
      status: generated
    - name: "{PROJECT}-DFD-DIAGRAM.md"
      type: dfd
      source: P2
      status: generated
    - name: "{PROJECT}-COMPLIANCE-REPORT.md"
      type: compliance
      source: P4
      status: generated
    - name: "{PROJECT}-ATTACK-PATH-VALIDATION.md"
      type: attack_paths
      source: P6
      status: generated

content_verification:
  p6_pocs_included: true
  p6_pocs_count: 0
  p6_attack_chains_included: true
  p6_attack_chains_count: 0
  p7_mitigations_included: true
  p7_mitigations_count: 0

test_case_mapping:
  total_test_cases: 0
  poc_to_tc_mapping:
    - poc_id: "POC-xxx"
      tc_id: "TC-xxx"
  coverage:
    attack_paths_covered: 0
    attack_paths_total: 0
    coverage_percentage: 0.0

phase_outputs_published:
  - source: ".phase_working/{SESSION_ID}/reports/P1-*.md"
    target: "Risk_Assessment_Report/"
    status: copied
  # ... P2-P7

validation_result:
  all_reports_generated: true
  content_complete: true
  errors: []
  warnings: []

Core Analysis Goal

Synthesize all phase outputs into complete threat model documentation. Every finding, threat, risk, and mitigation from previous phases must be included - no omission.

Knowledge Reference

Query Commands:

$SKILL_PATH/kb --compliance nist-csf
$SKILL_PATH/kb --compliance iso27001
$SKILL_PATH/kb --asvs-level L2 --chapter V1

Report Generation Process

Step 1: Read All Phase Data Files

# Read each phase YAML data file (PRIMARY source)
.phase_working/{SESSION_ID}/data/P1_project_context.yaml
.phase_working/{SESSION_ID}/data/P2_dfd_elements.yaml
.phase_working/{SESSION_ID}/data/P3_boundary_context.yaml
.phase_working/{SESSION_ID}/data/P4_security_gaps.yaml
.phase_working/{SESSION_ID}/data/P5_threat_inventory.yaml
.phase_working/{SESSION_ID}/data/P6_validated_risks.yaml
.phase_working/{SESSION_ID}/data/P7_mitigation_plan.yaml

Step 2: Extract Structured Data

Use phase_data.py or manually extract:

• yaml:module_inventory from P1
• yaml:dfd_elements from P2
• yaml:threat_inventory from P5
• yaml:validated_risks from P6
• yaml:mitigation_plan from P7

Step 3: Generate Reports

Create all 8 mandatory reports in Risk_Assessment_Report/

Required Reports (8)

Report 1: Main Risk Assessment Report

File: {PROJECT}-RISK-ASSESSMENT-REPORT.md

Structure (9 Sections)

# {PROJECT} Risk Assessment Report

**Generated**: {timestamp}
**Skill Version**: 3.0.0
**Assessment Scope**: {project_path}

---

## 1. Executive Summary

### Key Findings
- **Total Risks Identified**: N
- **Critical (P0)**: N - Require immediate attention
- **High (P1)**: N - Fix within 24-48 hours
- **Medium (P2)**: N - Plan within 7 days
- **Low (P3)**: N - Backlog for 30 days

### Top 3 Critical Risks
1. VR-001: {title} - CVSS {score}
2. VR-002: {title} - CVSS {score}
3. VR-003: {title} - CVSS {score}

### Recommendations Summary
{High-level recommendations}

---

## 2. System Architecture Overview

{From P1: Project structure, modules, entry points}
{From P2: DFD summary}
{From P3: Trust boundary summary}

### Architecture Diagram
[ASCII or Mermaid diagram]

### Key Components
| Component | Type | Security Relevance |
|-----------|------|-------------------|
| {name} | {type} | {relevance} |

---

## 3. Security Design Assessment

{From P4: Complete security_gaps content}

### Assessment Matrix
| Domain | Rating | Gaps | Risk Level |
|--------|--------|------|------------|
| AUTHN | Partial | 2 | High |
| ... | ... | ... | ... |

### Critical Security Gaps
{Detailed gap descriptions}

---

## 4. STRIDE Threat Analysis

{From P5: Complete threat_inventory content}

### Threat Distribution
| STRIDE | Count | Critical | High | Medium | Low |
|--------|-------|----------|------|--------|-----|
| S | N | N | N | N | N |
| ... | ... | ... | ... | ... | ... |

### Threat Coverage
{Element-by-element threat mapping}

---

## 5. Risk Validation & POC Design ← CRITICAL SECTION

{From P6: Complete poc_details content - DO NOT SUMMARIZE}

### Validated Risks
{Full VR-xxx details with POC code}

### POC Summary
| POC ID | Risk | Status | Difficulty |
|--------|------|--------|------------|
| POC-001 | VR-001 | ✅ Verified | Medium |

---

## 6. Attack Path Analysis ← CRITICAL SECTION

{From P6: Complete attack_chains content - DO NOT SUMMARIZE}

### Attack Chain: {name}
[ASCII attack flow diagram]

### Feasibility Matrix
| Path ID | Entry | Target | Score | Priority |
|---------|-------|--------|-------|----------|
| AP-001 | API | Admin | 9.2 | Yes |

---

## 7. Threat Priority Matrix

### By Severity
| Priority | Count | Examples |
|----------|-------|----------|
| P0 | N | VR-001, VR-002 |
| P1 | N | VR-003, VR-004 |

### By STRIDE Category
{Distribution chart}

---

## 8. Mitigation Recommendations ← CRITICAL SECTION

{From P7: Complete mitigation_plan content - DO NOT SUMMARIZE}

### Immediate Actions (P0)
{Full MIT-xxx details with code}

### Implementation Roadmap
| Timeline | Actions | Owner |
|----------|---------|-------|
| Immediate | MIT-001, MIT-002 | Security |
| 7 days | MIT-003, MIT-004 | Backend |

---

## 9. Compliance Mapping

### Framework Coverage
| Framework | Coverage | Gaps |
|-----------|----------|------|
| OWASP Top 10 | 80% | A03, A07 |
| ASVS L2 | 65% | V3, V4 |
| ISO 27001 | 70% | A.12, A.14 |

### Gap Analysis
{Per-framework gap details}

---

## Appendices

### A. Complete Risk Inventory
See: {PROJECT}-RISK-INVENTORY.md

### B. Detailed Mitigations
See: {PROJECT}-MITIGATION-MEASURES.md

### C. DFD Diagrams
See: {PROJECT}-DFD-DIAGRAM.md

### D. Phase Working Documents
- P1-PROJECT-UNDERSTANDING.md
- P2-DFD-ANALYSIS.md
- P3-TRUST-BOUNDARY.md
- P4-SECURITY-DESIGN-REVIEW.md
- P5-STRIDE-THREATS.md
- P6-RISK-VALIDATION.md

Report 2: Risk Inventory

File: {PROJECT}-RISK-INVENTORY.md

# {PROJECT} Risk Inventory

## Summary Statistics
| Metric | Value |
|--------|-------|
| Total Risks | N |
| Critical | N |
| High | N |
| Medium | N |
| Low | N |

## Risk Listing

### VR-001: {title}
- **Priority**: P0
- **CVSS**: 9.8
- **STRIDE**: S, E
- **CWE**: CWE-287
- **Location**: src/api/auth.py:45
- **Description**: {description}
- **Threat Refs**: T-S-P-001-001, T-E-P-001-002
- **Mitigation**: MIT-001

### VR-002: {title}
...

Report 3: Mitigation Measures

File: {PROJECT}-MITIGATION-MEASURES.md

Complete P7 content with implementation details.

Report 4: Penetration Test Plan

File: {PROJECT}-PENETRATION-TEST-PLAN.md

Attack Path Coverage Requirement (CRITICAL)

Every P6 attack path and attack chain MUST have corresponding test coverage:

# Required section in PENETRATION-TEST-PLAN.md or P8_report_manifest.yaml
attack_path_coverage:
  # P6 Input Reference
  p6_input_ref: "P6_validated_risks.yaml"

  # Attack Path Coverage
  attack_paths:
    total_from_p6: 5              # Count of AP-xxx from P6
    paths_with_test_cases: 5      # AP-xxx that have TC-xxx
    coverage_percentage: 100      # SHOULD be 100%
    path_test_mapping:
      AP-001: [TC-001, TC-002]    # Test cases for this path
      AP-002: [TC-003]
      AP-003: [TC-004, TC-005]
      AP-004: [TC-006]            # Or "DEFERRED" with reason
      AP-005: [TC-007]
    uncovered_paths: []           # Paths without test cases
    deferred_paths:               # Paths intentionally not tested
      - path_id: AP-004
        reason: "Requires production environment access"
        planned_date: "2026-Q2"

  # Attack Chain Coverage
  attack_chains:
    total_from_p6: 3              # Count of AC-xxx from P6
    chains_with_scenarios: 3      # AC-xxx that have test scenarios
    coverage_percentage: 100
    chain_scenario_mapping:
      AC-001: "Full privilege escalation scenario"
      AC-002: "Data exfiltration scenario"
      AC-003: "Lateral movement scenario"
    uncovered_chains: []

  # Validated Risk Coverage
  validated_risks:
    total_from_p6: 15             # Count of VR-xxx from P6
    risks_with_tests: 15          # VR-xxx that have TC-xxx
    coverage_percentage: 100
    risk_test_mapping:
      VR-001: [TC-001, TC-002]
      VR-002: [TC-003]
      # ... all VRs

  # Overall Coverage Summary
  overall:
    total_attack_artifacts: 23    # AP + AC + VR
    artifacts_covered: 23
    coverage_percentage: 100

Validation Rules:

• Every AP-xxx from P6 should have at least one TC-xxx or documented deferral reason
• Every AC-xxx from P6 should have a test scenario description
• Every VR-xxx (Critical/High) from P6 must have test coverage

WARNING: attack_paths.coverage_percentage < 100% (allows deferred paths) WARNING: validated_risks.coverage_percentage < 100% for non-Critical/High

Report Template

# {PROJECT} Penetration Test Plan

## Scope
{From P1: entry points, modules}

## Attack Path Coverage Summary
| P6 Artifact | Count | Covered | Coverage |
|-------------|-------|---------|----------|
| Attack Paths (AP-xxx) | N | N | 100% |
| Attack Chains (AC-xxx) | N | N | 100% |
| Validated Risks (VR-xxx) | N | N | 100% |

## Test Cases

### TC-001: JWT Token Forgery
- **Attack Path**: AP-001
- **Risk**: VR-001
- **POC**: POC-001
- **Prerequisites**: {list}
- **Steps**: {exploitation steps}
- **Expected Result**: {expected outcome}
- **Verification**: {how to verify}

### TC-002: SQL Injection
...

## Attack Chain Scenarios

### Scenario 1: Privilege Escalation (AC-001)
- **Chain**: AP-001 → AP-002
- **Test Cases**: TC-001, TC-002, TC-003
- **End-to-End Steps**: {full attack chain steps}

## Deferred Tests
| Path/Chain | Reason | Planned Date |
|------------|--------|--------------|
| AP-004 | Requires production access | 2026-Q2 |

## Tools Required
- Burp Suite
- sqlmap
- jwt_tool

## Test Environment
{Environment requirements}

Report 5: Architecture Analysis

File: {PROJECT}-ARCHITECTURE-ANALYSIS.md

Synthesis of P1-P3 content.

Report 6: DFD Diagram

File: {PROJECT}-DFD-DIAGRAM.md

P2 DFD content with Mermaid source.

Report 7: Compliance Report

File: {PROJECT}-COMPLIANCE-REPORT.md

P4 gaps mapped to compliance frameworks.

Report 8: Attack Path Validation

File: {PROJECT}-ATTACK-PATH-VALIDATION.md

Complete P6 attack chains with diagrams.

Phase Output Publication

Copy from .phase_working/{SESSION_ID}/reports/ to Risk_Assessment_Report/:

cp .phase_working/{SESSION_ID}/reports/P1-PROJECT-UNDERSTANDING.md Risk_Assessment_Report/
cp .phase_working/{SESSION_ID}/reports/P2-DFD-ANALYSIS.md Risk_Assessment_Report/
cp .phase_working/{SESSION_ID}/reports/P3-TRUST-BOUNDARY.md Risk_Assessment_Report/
cp .phase_working/{SESSION_ID}/reports/P4-SECURITY-REVIEW.md Risk_Assessment_Report/
cp .phase_working/{SESSION_ID}/reports/P5-STRIDE-THREATS.md Risk_Assessment_Report/
cp .phase_working/{SESSION_ID}/reports/P6-RISK-VALIDATION.md Risk_Assessment_Report/
cp .phase_working/{SESSION_ID}/reports/P7-MITIGATION-PLAN.md Risk_Assessment_Report/

Content Aggregation Rules

CRITICAL: These sections MUST include COMPLETE content from referenced phases:

Prohibited Actions:

• ❌ "See P6 for details"
• ❌ "Top 3 risks shown, others omitted"
• ❌ Summarizing POC code
• ❌ Truncating attack chains

Validation Gates

Completion Checklist

Before marking Phase 8 complete:

Report Generation:

• All 8 reports created in Risk_Assessment_Report/
• Main report includes complete P6 POCs
• Main report includes complete P7 mitigations
• Attack chain diagrams included

Penetration Test Plan Coverage:

• attack_path_coverage section present in pentest plan
• Every AP-xxx has test cases or documented deferral
• Every AC-xxx has test scenario description
• Every VR-xxx (Critical/High) has test coverage

Finalization:

• Phase outputs published
• _session_meta.yaml updated
• Validation passed

End of Phase 8 Instructions (~300 lines, ~2.5K tokens)