skills.rest
waybarrios
waybarriosCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vuln-report

Drafts disclosure-ready GitHub security advisory reports for confirmed vulnerabilities.

507|40|Updated Apr 26, 2026
Search Tags:#root cause#github#proof of concept#cve#disclosure#vulnerability report#security advisory
One-click install
npx skills add https://github.com/waybarrios/opencode-power-pack --skill vuln-report-waybarrios
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-report
Source: https://github.com/waybarrios/opencode-power-pack/tree/main/skills/vuln-report
Command: npx skills add https://github.com/waybarrios/opencode-power-pack --skill vuln-report-waybarrios

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Writing a clear, evidence-driven vulnerability report for a confirmed security bug is time-consuming and error-prone; this Skill turns one confirmed finding into a disclosure-ready GitHub advisory with consistent structure and verifiable evidence. ## Core Features & Use Cases - Structured Report Generation: Produces a report with required sections (Summary, Details, Root Cause, Proof of Concept, Impact) following a defined template. - Evidence Linking: Embeds fenced code snippets and GitHub markdown links pinned to commit SHAs so source references remain stable. - Severity-Based Organization: Saves each report as report.md inside a folder named with a severity ID (C1, H1, M1) and title slug, skipping Low severity findings. - Use Case: After confirming a cross-site WebSocket hijacking bug in a repository, use this Skill to produce a self-contained advisory with PoC steps, root cause analysis, and linked source evidence ready to paste into a GitHub security advisory. ## Quick Start Write a disclosure-ready vulnerability report for the confirmed bug I just validated in this repository.

Frequently Asked Questions about vuln-report

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I write a vulnerability report for a confirmed security bug?▼

Provide the confirmed finding with its vulnerable component, attacker-controlled input, and exploit result. The Skill drafts a report with Summary, Details, Root Cause, Proof of Concept, and Impact sections, embedding code snippets and GitHub source links as evidence.

What sections should a GitHub security advisory include?▼

A disclosure-ready advisory includes Summary, Details, Root Cause, Proof of Concept, and Impact as required sections. Optional sections like CWE, CVSS vector, and patch commit metadata are added only when they provide concrete triage value.

Can this Skill discover or validate new vulnerabilities?▼

No, it only reports already confirmed vulnerabilities. Discovery and validation must happen beforehand; the Skill's scope is turning one established finding into a well-structured, evidence-backed disclosure document.

How are vulnerability report files organized and named?▼

Each report is saved as report.md inside a folder named with a severity identifier (C for Critical, H for High, M for Medium, sequentially numbered) plus a lowercase hyphenated title slug, such as C1-cross-site-websocket-hijacking. Low severity findings are not reported individually.

Why should GitHub source links use commit SHAs instead of branch names?▼

Commit SHA links remain stable after future commits change the code, while branch-based links like main or master can drift and point to different lines. Pinning to the latest commit SHA keeps evidence references accurate over time.

Related Skills

Explore More Software Engineering Skills→
gerald-icagerald-ica

API Fuzzing for Bug Bounty

Fuzz test REST, SOAP, and GraphQL APIs to detect security vulnerabilities.

Community
Advanced
Mothership-FoundryMothership-Foundry

deal-with-security-advisory

Coordinate confidential GitHub security advisory responses with private forks and synchronized publication.

Official
Advanced
DauQuangThanhDauQuangThanh
14

code-security-review

Identify and remediate security vulnerabilities with OWASP Top 10 and CWE mappings.

Community
Advanced
l8yh1l8yh1

security_scan

Run three security scanners and compile a prioritized vulnerability report.

Community
Intermediate