final-report

Files (1)

• SKILL.md

SKILL.md (first lines)

# Final Engagement Report Generation

**Execute when all OPPLAN objectives are in `passed` or `blocked` status. Output is two Markdown documents in `report/`.**

## Report Generation Workflow

```
1. Read all findings/*.md              (parse YAML frontmatter for metadata)
2. Read all findings/attack-paths/PATH-*.md
3. Read timeline.jsonl                 (activity log)
4. Read plan/roe.json + plan/conops.json + plan/deconfliction.json  (engagement context)
5. Read plan/opplan.json               (objective status summary)
6. Generate report/executive-summary.md
7. Generate report/technical-report.md
8. (Optional) Refresh findings.md with final summary
```

### Step 1: Initialize Output Directory

```
bash(command="mkdir -p /workspace/report")
```

### Step 2: Aggregate Findings

Read every `findings/*.md` (named `{severity}-{slug}.md`) and extract frontmatter fields:

```
for each FIND-xxx.md:
  - id, title, severity, cvss, target, phase, technique (ATT&CK ID), status, confidence
```

Sorting rules:
- Primary: severity (`critical` → `high` → `medium` → `low` → `informational`)
- Secondary: CVSS score descending
- De-duplicate findings that appear across multiple objectives (keep highest-severity instance)
- Flag `confidence: unverified` findings — they require a disclaimer note in the report

### Step 3: Generate Executive Summary

Write to `report/executive-summary.md` using the template below. Use plain business language throughout — zero technical jargon.

---

```markdown
# Executive Summary
## [Engagement Name] — Penetration Test Results

**Prepared for**: [Client Name]
**Engagement Period**: [Start Date] – [End Date]
**Conducted by**: Decepticon Autonomous Red Team
**Classification**: CONFIDENTIAL

---

## Engagement Overview

[2–3 sentences: what was tested, why, what methodology was used.
Example: "Between [dates], [client] engaged the red team to assess the
security posture of [scope]. The assessment simulated a [threat actor
archetype from conops.json] targeting [primary objective from roe.json].
Testing followed the Penetration Testing Execution Standard (PTES) and
MITRE ATT&CK framework."]

---

## Key Metrics

| Metric | Value |
|--------|-------|
| Total Findings | [N] |
| Critical | [N] |
| High | [N] |
| Medium | [N] |
| Low / Informational | [N] |
| Objectives Completed | [N] / [total] |
| Objectives Blocked | [N] / [total] |
| Attack Success Rate | [%] |
| Detection Rate | [%] (findings detected by existing controls) |

---

## Top 3 Critical Findings

### 1. [FIND-ID]: [Title]
[1 paragraph, business impact focus. No CVE numbers, no tool names.
Example: "Attackers with internet access can gain full administrative
control of the company's customer database without any valid credentials.
This would allow theft of all customer records, potential regulatory
fines under GDPR, and complete loss of customer trust."]

### 2. [FIND-ID]: [Title]
[1 paragraph, business impact focus]

### 3. [FIND-ID]: [Title]
[1 paragraph, business impact focus]

*[If fewer than 3 critical findings, use highest-severity findings available.]*

---

## Overall Risk Rating

**[CRITICAL / HIGH / MEDIUM / LOW]**

[2–3 sentences justifying the rating in business terms. Consider: ease of
exploitation, potential business impact, data sensitivity, regulatory exposure.
Example: "The overall risk is rated CRITICAL because an unauthenticated
attacker on the internet achieved domain administrator access within [X]
minutes, with no detection by existing security controls. This represents
a complete failure of the network perimeter and would result in total
compromise of all company systems."]

---

## Strategic Recommendations

1. **[Recommendation 1 — address most critical finding]** — [1 sentence, business language, e.g. "Immediately restrict internet access to the database server and require multi-factor authentication for all administrative accounts."]
2. **[Recommendation 2]** — [1 sentence]

From dazeb/botron, Apache-2.0.

More from dazeb/botron