CtrlK
BlogDocsLog inGet started
Tessl Logo

redteam-report-template

Client-facing red-team deliverable format — codifies the Subject / Observations / Description / Impact / Recommendation / PoC structure used for external red-team engagements (not bug-bounty platform reports). Different audience, different tone, different cadence. Built from an authorized engagement deliverable where 14 findings were packaged into a 52KB MD + 2.2MB DOCX with 16 embedded screenshots. Use when the engagement is "external red team for an enterprise client" (not H1/Bugcrowd/Intigriti), when generating the final report, when the client has specified a custom report format, or when packaging findings into DOCX/PDF.

68

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

High

Do not use without reviewing

SKILL.md
Quality
Evals
Security

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable and well-sequenced, packed with red-team-specific expertise and executable tooling that Claude could not derive independently. Its main weaknesses are duplicated neighboring-skills content, a verification step without an explicit recovery loop, and a monolithic structure that references template files not actually bundled.

Suggestions

Merge the 'Bridge to neighboring skills' and 'Related Skills & Chains' sections into one to remove the near-duplicate listing.

Add an explicit error-recovery branch to the DOCX pipeline ('if embedded image count != MD reference count, re-check --resource-path and screenshot paths').

Move reusable boilerplate (executive_summary.md, methodology.md, cleanup_statement.md, reference.docx) into actual bundle files under templates/ and replace the inlined template library with one-level-deep references, or drop the references if the files are not bundled.

DimensionReasoningScore

Conciseness

Most of the body is genuinely expert, non-obvious content Claude would not already know (red-team status field, severity-vs-CVSS calibration, audience-translation table), but the 'Bridge to neighboring skills' and 'Related Skills & Chains' sections duplicate each other almost entirely, and 'Mistakes to avoid' overlaps 'Anti-patterns'.

4 / 5

Actionability

Provides a copy-paste-ready pandoc DOCX command, an executable python-docx image-count verification script, a concrete 6-section finding markdown template, an image filename convention with worked examples, and a pre-delivery checklist — fully executable guidance covering the common cases.

5 / 5

Workflow Clarity

The 8-step document-level structure and the pandoc pipeline (convert → verify image count) are clearly sequenced with a validation checkpoint and pre-delivery checklist, but the image-count verification lacks an explicit error-recovery loop ('if counts mismatch, do X'), leaving a minor validation gap.

4 / 5

Progressive Disclosure

Well-organized with clear section headers, but at ~340 lines it is monolithic: the 'Template library' points at templates/ files (executive_summary.md, methodology.md, reference.docx) that are not present as bundle files, and reusable material (templates, real-engagement metrics, the duplicated skills-bridging) is inlined rather than split into one-level-deep references.

3 / 5

Total

16

/

20

Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is explicit, specific, and trigger-rich, clearly stating both what the skill does and when to use it while actively disambiguating it from bug-bounty reporting skills. Its only weakness is slightly incomplete synonym coverage and one sentence of calibration background that is not a capability statement.

Suggestions

Consider adding 'pentest report' and 'security assessment deliverable' as trigger synonyms to broaden natural-term coverage.

Trim or relocate the 'Built from an authorized engagement deliverable where 14 findings...' calibration sentence so the description leads with capabilities rather than provenance.

DimensionReasoningScore

Specificity

Names the domain (red-team deliverable format) and several concrete actions — 'codifies the Subject / Observations / ... / PoC structure', 'packaging findings into DOCX/PDF', 'generating the final report' — but the 'Built from an authorized engagement...' sentence is calibration background rather than a capability, leaving minor coverage gaps.

4 / 5

Completeness

Explicitly answers both what ('Client-facing red-team deliverable format — codifies the ... structure') and when ('Use when the engagement is "external red team for an enterprise client"... when generating the final report... when packaging findings into DOCX/PDF') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural-phrase coverage — 'external red team for an enterprise client', 'final report', 'custom report format', 'packaging findings into DOCX/PDF', plus platform names 'H1/Bugcrowd/Intigriti' — but common synonyms like 'pentest report' and 'security assessment' are absent.

4 / 5

Distinctiveness Conflict Risk

Carves a clear niche (external red-team / enterprise client deliverables) and actively distinguishes it from adjacent skills via 'not bug-bounty platform reports' and 'not H1/Bugcrowd/Intigriti', minimizing wrong-skill triggering.

5 / 5

Total

18

/

20

Passed

Validation

87%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation14 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 1 missing

Warning

Total

14

/

16

Passed

Repository
elementalsouls/Claude-BugHunter
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.