Vuln Report Skill

report — Submission-Ready Vulnerability Reports (Claude Code Skill)

[English](#english) | [中文](#中文)

---

工作流程 / Workflow

flowchart TD
    A0["挖掘中遇到信号"] --> A1{"⓪ 信号快筛
止损 / 待验证 / 候选"}
    A1 -->|"明显不够格"| A2["当场止损，不烧 token 深挖"]
    A1 -->|"候选漏洞"| A["验证确认（有 PoC、打到真实危害）"]
    A --> B["触发：/report 或「写报告」"]
    B --> C{"① 查重
同资产+同根因+同接口+同影响面?"}
    C -->|"撞车"| C1["不新写 → 补强旧报告 / 换资产"]
    C -->|"无重复"| D{"② 分层验证门
硬门 + 类型命门"}
    D -->|"硬门缺一"| D1["打回继续验证，不允许开写"]
    D -->|"全过"| E["③ 生成 DOCX
章节骨架 + Step 式 PoC + 真实截图"]
    E --> F["④ 语义化命名 + 归档"]
    F --> G{"平台审核"}
    G -->|"驳回"| H["⑤ 底部追加申诉证据（不重写）"]
    G -->|"通过"| I["收录 ✓"]

效果预览 / Demo

演示对象为虚构靶标 `demo-shop.example`，仅展示生成报告的版式与结构；第 3 张为公共靶场（AltoroJ / demo.testfire.net）实拍，演示真实浏览器渲染页的嵌入效果。 Demo uses a fictional target to showcase the layout of generated reports; page 3 is a real browser capture from a public practice target, showing how rendered pages are embedded.

报告首页（章节骨架）	PoC 步骤页（Step + 请求块 + JSON 截图）	PoC 步骤页（真实浏览器渲染截图）

---

English

A Claude Code skill that turns **confirmed** vulnerabilities into submission-ready **DOCX** reports for SRC (Security Response Center) and 0day platforms.

It doesn't find vulnerabilities — it makes sure the **report** is good enough to survive review.

What it enforces

• Two-stage review: a lightweight signal triage runs while digging (stop-loss on dead ends before burning tokens on verification) + full layered verification gates before writing (hard gates: reproducible PoC / impact driven to the final harm / server-side confirmation / falsification tests; per-type criteria for data leak, IDOR, RCE, SSRF, injection; 0day acceptance gates). No gate, no report — this filters out "signal ≠ vulnerability" garbage at the source.
• Dual readability standard: a product manager can reproduce it step by step;