Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/crazymarky/pentest-skills/pentest-report)<a href="https://agentmods.dev/skills/crazymarky/pentest-skills/pentest-report"><img src="https://agentmods.dev/badge/skills/crazymarky/pentest-skills/pentest-report/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/crazymarky/pentest-skills/pentest-report"><img src="https://agentmods.dev/badge/skills/crazymarky/pentest-skills/pentest-report.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.01933 |
| Opus 5 | $0.00046 | $0.00966 |
| Sonnet 5 | $0.00018 | $0.00387 |
| Haiku 4.5 | $0.00009 | $0.00193 |
Grade A, and why
pentest-report scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 212 lines — stays where its author put it; the contents beside it link to each section on GitHub.
渗透测试报告生成技能
授权声明
本 Skill 仅用于生成授权渗透测试的报告。使用前请确保：
- 测试已获得目标系统所有者的明确书面授权
- 所有漏洞发现均来自合法授权的测试活动
- 报告仅发送给授权人员
- 遵守当地法律法规和数据保护要求
未经授权的渗透测试是非法行为。
技能用途
在以下情况下使用此技能：
- 用户要求生成渗透测试报告
- 用户要求输出安全测试结果
- 用户需要总结漏洞发现
- 用户明确提到"按格式生成报告"或"按照模板"
报告格式要求
必需章节
所有报告必须包含以下章节，按顺序排列：
-
标题和项目信息表
- 格式：
# 渗透测试报告：[目标系统名称/项目名称] - 包含 4 字段表格：测试目标、测试时间、测试人员、报告日期
- 格式：
-
漏洞发现清单 (Vulnerability Summary)
- 表格形式，包含列：ID、漏洞标题、风险等级、状态
- ID 格式：VL-001, VL-002, VL-003...
- 风险等级图标：🔴严重、🟠高危、🟡中危、🔵低危、⚪信息
-
漏洞详情 (Detailed Findings)
- 每个漏洞一个独立章节
- 章节标题：
### [VL-XXX] 漏洞标题 - 必须包含 4 个子章节：
#### 2.1 漏洞描述#### 2.2 复现步骤 (Proof of Concept)#### 2.3 证据截图#### 2.4 修复建议
-
附录 (Appendix)
### 3.1 风险等级定义- 风险等级表格### 3.2 CVSS 评分说明- CVSS v3.1 说明### 3.3 泄露凭证列表（如有）### 3.4 测试工具参考- 工具表格### 3.5 词汇表### 3.6 参考文档
-
报告签署
- 测试人员信息
- 免责声明
漏洞详情章节格式
每个漏洞章节必须以属性表格开始：
| 属性 | 详情 |
| :--- | :--- |
| **风险等级** | 🔴 **严重 (Critical)** / 🟠 **高危 (High)** / 🟡 **中危 (Medium)** / 🔵 **低危 (Low)** |
| **CVSS 评分** | 0.0 - 10.0 |
| **漏洞类型** | [漏洞类型] |
| **受影响URL** | `[完整URL]` |
| **参数** | `[参数名]`（如有）|
代码块格式
- HTTP 请求使用
http语言标识
POST /api/login HTTP/1.1
Host: example.com
Content-Type: application/json
{"username":"admin","password":"123456"}
- Bash 命令使用
bash语言标识
sqlmap -u "http://target.com" --dbs
- PHP 代码使用
php语言标识
$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$id]);
工作流程
生成渗透测试报告时遵循以下步骤：
步骤 1: 收集信息
从用户获取以下信息：
- 测试目标（URL 或系统名称）
- 测试日期范围
- 测试人员信息
- 发现的漏洞列表
- 每个漏洞的详细信息（类型、影响、证据、PoC）
步骤 2: 确定漏洞 ID
为每个漏洞分配 ID：
- 第一个漏洞：VL-001
- 第二个漏洞：VL-002
- 以此类推
步骤 3: 评估风险等级
根据 CVSS 评分确定风险等级：
| CVSS 范围 | 风险等级 | 图标 |
|---|---|---|
| 9.0 - 10.0 | 严重 (Critical) | 🔴 |
| 7.0 - 8.9 | 高危 (High) | 🟠 |
| 4.0 - 6.9 | 中危 (Medium) | 🟡 |
| 0.1 - 3.9 | 低危 (Low) | 🔵 |
| 0.0 | 信息 (Info) | ⚪ |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 212 lines · 92 tokens per session scan A 0427f1ba047a
pentest-report is a skill published in the GitHub repository crazyMarky/pentest-skills (307 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 92 tokens to every session and 1,933 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
incident-response-fileanalyser
Static malware reverse-engineering and threat-intelligence triage for unknown files, Windows EXE/PE binaries, scripts, archives, ISOs, JavaScript, PowerShell, documents, and unpacked payloads. Use when a user provides a sample path, hash, filename, or file and asks whether it is malicious, benign, suspicious, contains…
pentest-cve-vulnerability-research-helper
CVE and vulnerability research skill for exact CVE lookup, product/version applicability, exploit maturity, KEV/PoC status, source ranking, contradiction handling, and non-destructive validation guidance.
pentest-web-enumeration
Authorized web enumeration for one or many websites or web applications, including live-target normalization, HTTP and TLS fingerprinting, technology and platform identification, virtual-host discovery, crawling, JavaScript and API endpoint extraction, focused directory and sensitive-file discovery, CMS-specific…
web-pentest-skill
Analyze supplied artifacts from authorized web assessments with bounded defensive reasoning, evidence review, resumable workflow planning, and static reporting. Use for offline artifact analysis and explicitly reviewed task planning; never for autonomous exploitation, unreviewed target scanning, or executing…
pentest-hacktricks-finder
Support skill for HackTricks technique research, payload ideas, bypasses, prerequisites, caveats, and edge-case behavior across web, network, cloud, and application security topics. Use as owner only when research is the current blocker.
incident-response-bec
BEC and AiTM incident-response skill for suspicious sign-ins, mailbox abuse, forwarding, inbox rules, session theft, token replay, consent abuse, and secondary phishing.