offensive-reporting

Penetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.

Quality

85%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-sequenced, with copy-paste templates, commands, and real scoring examples that assume Claude's competence. Its main weakness is monolithic single-file structure with no progressive disclosure or external references.

Suggestions

Split the CVSS vector reference table and tooling table into a separate reference file (e.g. references/cvss-vectors.md) and link to it from the body, adding one-level-deep progressive disclosure.

Trim rhetorical motivational sentences ('Treat the report with the same rigor as the exploit', 'Make it memorable') to improve token efficiency.

Add an explicit validation/feedback loop to the Quick Workflow (e.g. a checklist for the two-pass review) to push workflow clarity toward a 5.

Dimension	Reasoning	Score
Conciseness	Dense and mostly efficient — it avoids explaining concepts Claude already knows and earns most tokens with templates, vectors, and commands. A few motivational/rhetorical lines ('Treat the report with the same rigor as the exploit', 'Make it memorable') could be trimmed, keeping it just below a 5.	4 / 5
Actionability	Provides fully executable, copy-paste-ready guidance across common cases: a complete finding template, real CVSS v3.1 vectors with per-metric justification, a redaction command (`exiftool -all= *.png`), an evidence-log CSV header, and a Pandoc build command.	5 / 5
Workflow Clarity	The Quick Workflow section sequences capture → draft → executive summary → two-pass review → handoff, with an explicit two-pass review checkpoint. It is a writing skill (not a destructive/batch operation), so the validation cap does not apply; minor gaps in error-recovery feedback loops keep it at 4 rather than 5.	4 / 5
Progressive Disclosure	No bundle files exist (references/, scripts/, assets/ absent) and the ~370-line skill is a single monolithic file with no external references. Section headers provide structure, but content that could plausibly be split out (CVSS vector table, tooling table, deliverable-format table) is inlined, matching anchor 3.	3 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is comprehensive and specific, clearly articulating both the capability set and the trigger conditions for use. It is third-person, avoids fluff, and distinguishes itself well from adjacent skills.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions — executive summary structuring, technical finding format with enumerated fields, CVSS v3.1/v4.0 vector justification, evidence hygiene, and deliverable formats — giving comprehensive coverage of the reporting skill's capabilities.	5 / 5
Completeness	Explicitly answers both 'what' (the full reporting methodology scope) and 'when' with concrete trigger phrases: 'Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.'	5 / 5
Trigger Term Quality	Strong natural terms ('penetration test and red team report writing', 'executive summary', 'CVSS', 'retest evidence') but a few common synonyms users might say (e.g. 'pentest report', 'vulnerability report', 'security assessment writeup') are not surfaced.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (penetration test / red team report writing) with distinct triggers and minimal overlap risk against other skills; the specificity of 'red team report writing' and 'CVSS scoring with vector justification' makes misfiring unlikely.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: SnailSploit/Claude-Red
Path: Skills/utility/offensive-reporting/SKILL.md
Commit: 24d7968

Reviewed: ~5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.