Pentest reporting
Use to produce the final engagement report for a penetration test — assembles verified findings into a structured markdown report with severity, evidence, and remediation.From its SKILL.md
npx -y skills add mushhzz/umbra --skill pentest-reportingAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.8 KB, as published. Nobody here has run it
Pentest Reporting
Assemble the engagement's verified findings into a markdown report. Adapts a structured reporter output. Report in English (no per-engagement language switching).
A finding is "verified" only if it was verifier-confirmed — the inline verifier in
workflows/engagement.js, or the reflector subagent when driving the orchestration by
hand, reproduced the evidence and could not refute it.
Write the report to .umbra/reports/<target>-<date>.md. Do not invent findings;
include only what specialists produced and the verifier confirmed.
Structure
# Penetration Test Report — <target>
## Executive summary
2–4 sentences: overall posture, count of findings by severity, headline risk.
## Scope & authorization
- Authorized scope: <hosts/CIDRs from .umbra/scope.txt>
- Engagement window: <start–end>
- Host/network testing performed inside the disposable Kali Docker sandbox;
web-application testing performed via the agent-browser CLI.
## Findings
For each finding:
### [SEVERITY] Title
- **Affected:** host:port / URL / component
- **CVE / class:** <id or vuln class>
- **Evidence:** command(s) run + trimmed output (from the sandbox)
- **Impact:** what an attacker gains
- **Remediation:** concrete fix
- **Confidence:** verifier-confirmed (with the reproduction evidence)
## Methodology
Ordered list of subtasks executed and specialists used.
## Appendix
Full tool output references, in-scope-only.
Severity scale: Critical / High / Medium / Low / Info. Sort findings most-severe first. Keep evidence trimmed but reproducible. Never include out-of-scope hosts.