Agent skill · security · jeremylongshore
composing-vulnerability-report
Read findings JSONL files from cluster 1-4 skills, deduplicate by fingerprint, group by severity, and compose a deliverable- grade markdown vulnerability report with per-finding sections (title, severity, target, detail, remediation, evidence) and a top-level summary table. The canonical written artifact a customer receives at engagement close; precise, reproducible, machine- checkable against source findings. Use when: closing an engagement, generating an interim report, regenerating after CVE or OWASP enrichment, or producing the input for generating-executive-summary. Threshold: findings missing required fields are dropped. HIGH and CRITICAL findings highlighted in the summary section. Trigger with: "compose vuln report", "write pentest report", "generate vulnerability deliverable", "render findings to report".
Why this skill is useful
Adds a complete executable script for generating a structured vulnerability report from findings files, which includes deduplication and enrichment processes not commonly found in public documentation.
What it needs
Requires python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Composing Vulnerability Report Overview After cluster 1-4 scan skills run, each one produces a Findings file. A typical engagement ends up with eight to twenty such files across the different skill categories. The customer wants ONE vulnerability report — comprehensive, deduplicated, organized by severity, with each finding cross-referenced to its source skill and target. This skill consumes one or more findings files (JSONL preferred, JSON list also accepted), deduplicates entries by the canonical fingerprint defined in lib/finding.py, enriches each finding with a CVSS v3.1 vector when one isn't present (using a deterministic heuristic based on severity + category — explicitly noted as "derived, not assigned by NVD" in the output), and emits a single markdown report with per-finding sections plus a top-level summary table. The report has a defined structure that downstream tools (next two skills in cluster 6) consume: 1. Header — engagement ID, generation timestamp, source files 2. Summary table — finding count by severity 3. Per-severity sections — CRITICAL first, then HIGH, MEDIUM, LOW, INFO 4. Per-finding subsections — title, severity, target, detail, remediation, evidence, references When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Source file unparseable HIGH JSON/JSONL parse fails (operational) Finding missing required field HIGH A finding record is missing title, severity, target, detail, or remediation (operational) Duplicate fingerprint across files INFO Same finding appears in N>1 sources; reported as deduplication count (informational) Source file has zero findings INFO Empty or all-info-only file; reported but not an error (informational) Report generated cleanly INFO Positive confirmation (informational) Prerequisites Python 3.9+ One or more findings files in JSON or JSONL format produced by any cluster 1-4 scan skill (which all share lib/finding.py schema) Instructions Step 1 — Gather findings sources By def …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/composing-vulnerability-report