Pentest Reporter

Scope-only: report output may only contain information covered by the engagement Rules of Engagement. Findings outside scope (even when noticed) go via separate side-channel communication with the customer, not into the main report without explicit sign-off.

When to use

A pentest is done when the report is on paper, not when the testing stops. This skill connects the technical work from recon-agent, web-exploit-triage, exploit-chain, payload-crafter, ad-attacks, and post-exploit to a deliverable the customer can use to fix things, show to auditors, and prioritize internally.

Triggers on:

• A question like "write a pentest report for engagement X", "build the exec summary", "score these findings with CVSS", "build a remediation roadmap", "retest template".
• A bug-bounty submission that needs structure — lower bar than a full pentest report, same discipline.
• A red-team engagement where multiple reports (technical detail + exec summary + detection-gaps report) are needed.
• A retest cycle after an earlier report: per-finding sign-off plus overall attestation.
• A handoff from security-review when a found issue needs a formal finding entry.

When NOT (handoff)