> ## Documentation Index
> Fetch the complete documentation index at: https://community.rifteo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Pentest Report Generator

> Generates a complete, client-ready penetration test report from all findings in the current engagement executive summary, risk table, technical findings, and recommendations. Trigger when the user says "generate the report", "write the report", or "produce the deliverable", is at the end of an engagement with all findings confirmed and written up, or wants a draft report to review before sending to the client.

<Info>
  **Status:** Stable
  **Version:** 1.0.0
  **Author:** Rifteo
  **Tags:** pentest, reporting, security
</Info>

**Installation**

```bash theme={"system"}
rifteo-skills add pentest-report
```

***

## Summary

Turn all confirmed findings from a testing engagement into a single, client-ready penetration test report covering executive summary through technical appendices.

* Generates a cover page, executive summary (written for C-suite, no jargon), scope and methodology section, risk summary table ordered by severity, and full technical findings in `finding-writer` format
* Pulls from confirmed findings, `ENGAGEMENT.md`, and scope details asks for missing information (test dates, tester name) rather than inventing it
* Executive summary is written for a non-technical audience: what was tested, overall risk posture in plain language, the single most critical finding in business terms, and top 3 recommended actions
* Recommendations summary cross-references finding IDs (F-01, F-02...) with immediate, medium, and hardening actions ordered by severity

***

## SKILL.md file

<Accordion title="Discover skill details">
  ### Pentest Report Generator

  Turn all findings from a testing engagement into a single, client-ready penetration test report. Auditors spend 30–40% of engagement time on reporting. This skill handles the structure, ordering, and framing you provide the findings.

  #### What You Need Before Starting

  * Confirmed findings (from `finding-writer`)
  * Engagement scope and target (from `ENGAGEMENT.md` or `scope-grill` output)
  * Test dates and tester names (asked for if not available)

  #### How It Works

  **Section 1: Cover Page**

  Client name, engagement title, date range, classification (Confidential), prepared by.

  **Section 2: Executive Summary**

  3–5 paragraphs written for a non-technical audience (C-suite, board):

  * What was tested and why
  * Overall risk posture in plain language
  * The single most critical finding, in business terms
  * Top 3 recommended actions

  No technical jargon. No listing every finding.

  **Section 3: Scope and Methodology**

  In-scope targets, out-of-scope items, test type (black/grey/white box), test dates, tools and techniques (high level), and limitations.

  **Section 4: Risk Summary Table**

  | #    | Title                        | Severity | Component | Status    |
  | ---- | ---------------------------- | -------- | --------- | --------- |
  | F-01 | SQL Injection in /api/search | Critical | API       | Confirmed |

  Ordered by severity: Critical → High → Medium → Low → Info.

  **Section 5: Technical Findings**

  One section per finding in risk table order. Each finding uses the full `finding-writer` format: Title, Severity, CVSS, Description, Evidence, Impact, Recommendation, References.

  **Section 6: Recommendations Summary**

  Ordered action list immediate (Critical/High) first, then Medium, then hardening. Cross-references finding IDs.

  **Section 7: Appendices (if applicable)**

  Full tool output, scope confirmation letter reference, methodology references.

  #### Output

  A complete, client-ready penetration test report in markdown format, ready for conversion to PDF or Word.

  #### Known Limitations

  * The executive summary must be understandable by someone with no security background
  * Never includes unconfirmed findings suspected issues are marked "Requires Further Testing"
  * Every finding in the report must have a corresponding ID in the risk table
  * No generic security advice unrelated to the engagement
</Accordion>

***

## Benchmark Results

Tested on claude-sonnet-4-6 via Claude Code CLI. Same prompt, same model, same target. The only variable is whether the skill is loaded.

| Metric            | Without Skill | With Skill |
| ----------------- | ------------- | ---------- |
| Turns to complete | 1             | 1          |
| Response tokens   | \~7,144       | \~5,444    |
| Total time        | 128s          | 100s       |

***

## Related skills

<CardGroup cols={3}>
  <Card title="finding-writer" href="/skills/finding-writer">
    Convert raw pentest notes into structured audit findings ready for reporting
  </Card>

  <Card title="scope-grill" href="/skills/scope-grill">
    Interviews the user about a pentest engagement before any testing begins
  </Card>

  <Card title="engagement-handoff" href="/skills/engagement-handoff">
    Documents the current engagement state so the next session can continue without losing context
  </Card>
</CardGroup>