lockpick-explain
Explain a Lockpick report
Two jobs: turn a report into a short, honest summary a founder can act on, and draft answers to a customer's security questionnaire using only what the latest report shows.
Get the report
With the Lockpick CLI or MCP connected (see the lockpick skill), read the latest run directly: lockpick status <site>, lockpick run <runId> and lockpick findings <runId> --all (MCP lockpick_project_status, lockpick_get_run, lockpick_list_findings). Otherwise the user opens the run in the Lockpick web app and pastes the parts you need: the grade, the findings with their severity and repair guidance, "Checked and fine", and the coverage section. A shared result link works too.
Always note the run's date and depth (Quick check, Pulse or Deep). An answer is only as current as the run behind it.
Plain-English summary
Write for someone who runs the business, not the servers. Keep it under a page.
- Headline. One sentence with the grade and what it means in practice. "Your site is in good shape on the basics, with two things worth fixing this week."
- What to fix first. Up to three findings, highest severity first. For each, say what someone could do with it today, who fixes it (the user in their DNS host, their developer, their email provider or their hosting provider), and roughly how long it takes. Use the report's own words for the risk and do not make it sound worse or better.
- What is already fine. Two or three items from "Checked and fine". It shows the check was real.
- What was not covered. Say plainly what the depth did not look at (for example, a Pulse does not read pages behind a login and a Deep scan does not test sign-in flows). Unknown stays unknown.
- Next step. Usually "fix the first item, then request a recheck".