This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Composing Vulnerability Report
Overview
After cluster 1-4 scan skills run, each one produces a Findings
file. A typical engagement ends up with eight to twenty such files
across the different skill categories. The customer wants ONE
vulnerability report — comprehensive, deduplicated, organized by
severity, with each finding cross-referenced to its source skill
and target.
This skill consumes one or more findings files (JSONL preferred,
JSON list also accepted), deduplicates entries by the canonical
fingerprint defined in lib/finding.py, enriches each finding
with a CVSS v3.1 vector when one isn't present (using a deterministic
heuristic based on severity + category — explicitly noted as
"derived, not assigned by NVD" in the output), and emits a single
markdown report with per-finding sections plus a top-level
summary table.
The report has a defined structure that downstream tools (next
two skills in cluster 6) consume:
Usage: compose_report.py PATH [OPTIONS]
Options:
--source FILE Specific findings file (repeatable; overrides default glob)
--report-output FILE Write the composed report here (default:
PATH/reports/vulnerability-report.md)
--engagement-id ID Override the engagement ID (default: parse from PATH/roe.yaml)
--output FILE Operational findings output (this skill's own findings)
--format FMT json | jsonl | markdown (default: markdown)
--min-severity SEV Filter report to findings at or above this severity
--include-info Include INFO-severity findings in the report (default: omit)
Step 3 — Review the report
The output report has a predictable structure. The header
identifies the engagement, the source files, and the generation
timestamp. The summary table shows finding counts by severity.
Per-severity sections follow.
Each finding subsection includes a stable anchor (the fingerprint)
so cross-references from later artifacts (executive summary,
OWASP mapping) resolve into the report cleanly.
Re-run after mapping-findings-to-owasp-top10 has enriched each
finding with its OWASP category; the regenerated report includes
the OWASP tag in each per-finding subsection.
Output
JSON / JSONL / Markdown per lib/report.py for the skill's own
operational findings. The PRIMARY output is the composed
vulnerability report, written as standalone Markdown to the
--report-output path.
Each operational Finding includes:
id — compose::<issue>::<source-file>
severity — CRITICAL / HIGH / MEDIUM / INFO
category — report-composition
summary — what went wrong (or right) during composition
