Security reporting
AppSec Skills — 15 plug-and-play Claude Code security skills that audit, harden, and fix any website or app before you ship it. OWASP Top 10, auth, API, database, frontend, backend, cloud, dependencies, secrets, and pentest-style checks — all defensive, all evidence-based.
npx -y skills add Rootx202/appsec-skills --skill security-reportingAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
3 things to look at
- 26 days oldThe repository was created 26 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Generates a professional, consolidated security report (Markdown or HTML) from findings produced by other security skills, including an executive summary and an overall security score out of 100. Use at the end of any security audit/scan/pentest-style session, or whenever the user asks for a formal write-up of security findings for any project.
SKILL.md
2.5 KB, 475 tokens by cl100k_base, as published. Nobody here has run it
Security Reporting — Final Report Generator
A skill for consolidating the results of any prior security assessment (from code-audit, vulnerability-scanner, database-security, etc.) into a single professional report.
When to use this
- At the end of any security assessment session
- Explicit request for a formal report (for an employer, client, or internal record)
Mandatory Report Structure
# Security Report — [Project Name]
Date: [YYYY-MM-DD]
## Executive Summary
[3–5 sentences: scope of the assessment, key findings, overall posture]
## Security Score: XX/100
## Findings Breakdown
| Severity | Count |
|---|---|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |
## Critical Issues
[For each: Vulnerability/Severity/Location/Impact/Proof/Fix]
## High Issues
[...]
## Medium Issues
[...]
## Low Issues
[...]
## Fixed Issues
[Any fixes applied during this session via remediation-engine]
## Remaining Risks
[Any unresolved finding, and why — pending decision, technical complexity, etc.]
## Recommendations
[General recommendations: recurring review cadence, automated security tests in CI, team training, etc.]
## Production Readiness
Production Ready: YES / NO
[Brief justification for the verdict]
Security Score Methodology (out of 100)
Start at 100 and subtract by severity (a guideline — adjust for project scale and context):
- Each Critical finding: -15
- Each High finding: -8
- Each Medium finding: -3
- Each Low finding: -1
- Floor at 0
Any single unresolved Critical finding automatically forces Production Ready: NO, regardless of the overall numeric score.
Rules
- The report is based only on findings actually produced during this session by the other skills — never fabricate findings to pad the report.
- Use professional, decision-maker-friendly language in the executive summary (the reader may not be deeply technical), and precise technical language in the detailed findings.
- If requested, produce an HTML version with the same structure, using available file-creation tools (defer to the docx/pdf skill if the user wants Word or PDF instead of Markdown/HTML).
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.