finding-report
Interpret finding verdicts, preserve evidence fields and present justified severity and remediation.
76%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
Fix and improve this skill with Tessl
tessl review fix ./packages/decepticon/decepticon/skills/standard/finding_reporter/finding-report/SKILL.mdFinding report
A finding's evidence references, verification_status and
verification_rationale constrain its supported conclusions. The selected
workflow owns authorship, canonical paths, completion and handoff.
Verdict handling
| Verdict | Treatment |
|---|---|
verified | Describe what was reproduced. For result_kind: vulnerability, score only with a justified cvss_score call and record its base_score. A verified negative result remains coverage, not a vulnerability. |
unverified | Explain the constraint and the next discriminating test. Do not assert the claimed impact as fact. |
false_positive | Preserve the rebuttal for coverage accounting. Do not assign a vulnerability score or remediation priority. |
For result_kind: negative_result or observation, report what was tested or
seen and what it does not prove. Do not turn it into a vulnerability.
Canonical document
Preserve all existing frontmatter, including id, objective_id, target,
evidence_pointer, evidence_manifest, result_kind, verdict and rationale.
Complete supported fields such as severity_rationale, cvss_vector,
cvss_score, cvss_version, cwe, mitre, remediation_priority, and
report_status. Unknown values may remain absent. Use sections for Summary,
Verification, Steps to Reproduce, Proof of Concept, Attack Scenario, Impact,
Controls and Limitations, CVSS, Remediation, and References. Cite exact paths.
The final engagement report links to the canonical finding rather than creating
a second record with an independently mutable verdict.
- Repository
PurpleAILAB/Decepticon
- Revision
49888ee
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.