testssl Inspector Expert

Use this skill when reviewing findings produced by /testssl-inspector:scan. The connector wraps testssl.sh and emits v1 Findings against tls_endpoint resources; this skill translates those into remediation advice an engineer can act on and audit evidence a reviewer can sign off.

Reading the output

Findings live at ~/.cache/claude-grc/findings/testssl-inspector/<run_id>.json. Each document covers one TLS endpoint:

• resource.type = "tls_endpoint", resource.id = "<host>:<port>", resource.uri = "https://<host>:<port>/" for HTTPS or resource.uri = "starttls+<proto>://<host>:<port>/" for STARTTLS scans
• evaluations[] — one entry per (control_framework, control_id, testssl finding) tuple
• findings[] — narrative roll-up for CVEs and critical results (cap 50 per doc)
• metadata.target, metadata.effective_target, metadata.host, metadata.port, metadata.starttls — the original input, the port-expanded target actually scanned, the parsed host/port, and the STARTTLS protocol when applicable

What testssl IDs mean

Most fails fall into one of five families. The remediation pattern is the same within each family.

Family 1 — Weak protocol offered