Report

确认漏洞后产出正式 SRC/0day 提交稿 DOCX 报告的收口 skill。仅在漏洞已确认、准备成稿时使用——负责查重、过分层验证门、按固定 DOCX 骨架生成报告（Heading 2 章节 + Step 式 PoC + 内嵌真实截图）、语义化命名、放对目录、处理驳回追加。不负责挖掘/验证漏洞本身。TRIGGER：用户说"写报告/出报告/成稿/提交稿/生成漏洞报告"，或漏洞已验证到位准备交付时；或 /report。EN: Turns confirmed vulnerabilities into submission-ready DOCX reports for SRC/0day platforms (verification gates, fixed layout, step-style PoC, mandatory real screenshots). Trigger on "write report" or /report.

87 stars 4 forksDocuments & Office Files

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add v-yun/vuln-report-skill --skill report

Manual install

git clone --depth 1 https://github.com/v-yun/vuln-report-skill.git /tmp/vuln-report-skill
mkdir -p ~/.claude/skills
cp -r /tmp/vuln-report-skill/. ~/.claude/skills/report

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# report — 漏洞报告成稿收口

> **EN**: This skill turns confirmed vulnerabilities into submission-ready DOCX reports. The body is in Chinese because the target platforms (Chinese SRCs, CNVD/CNNVD, EDUSRC) require Chinese reports; the methodology is language-agnostic. See README.md for an English overview.

> 这是**薄编排层**，只做一件事：把**已确认**的漏洞写成可直接提交给审核方的 **DOCX** 提交稿。
> 漏洞怎么挖、怎么验证不在本 skill 范围；但"什么漏洞够格写成报告"的**分层验证门已内联在本文**，自成一体。

## 总纲：三条硬指标 + 一条生产原理（其余章节全部服务于这四句）

**指标一 质量碾压**：同批报告里审核最先看懂、最没得挑的是我们的。护城河四件套，每份报告必有：
- **首屏判决书**——名称+等级+一句话终局危害，审核 30 秒抓住全貌（他一天看几十份，谁省他时间谁赢）
- **零摩擦复现**——报文原字节可重放，有条件就配双击即用的复现工具（HTML 工具/脚本），审核不用动脑就能验
- **证据密度**——每个关键声明旁边就是截图/报文，全文没有一句需要"相信我"；数字全部实测（"实测3条跨3省、工号空间每前缀1万、oracle 引导"这种写法），禁"可能导致严重信息泄露"式空话
- **危害独立成节且量化**——这是和别人拉开差距的主段，不是描述段的附庸

**指标二 速度**：竞测按提交时间判 dup。内容一次写对、改=整体重写、全文循环≤2轮；同平台第二份起 15 分钟出稿（骨架缓存填空）。

**指标三 省 token**：生产原理=**报告 = 缓存骨架 + 已归档证据 + 约 15 句本洞独特内容**。模型只写那 15 句（发现过程的关键判断、根因一句、危害数字、修复点），其余全是拼装——章节定式、平台要件、格式、图注套话都不该现场生成。证据在挖的时候已归档（req.raw/resp.raw/截图+一行溯源），报告期回头重抓一次都算违规。

**冲突裁决**：质量 > 速度 > 省 token。但三者 90% 场景不冲突——冲突通常意味着在错的层打补丁（回 md 层整节重写）。

## 何时用 / 何时不用

- ✅ 用：漏洞已确认（硬门过了）、准备成稿交付、扩大危害后更新报告、被驳回后追加申诉。
- ❌ 不用：还在挖 / 还在验证 / 只有单点信号没到终局 → 继续验证，别急着开报告。

**前置铁律**：无 PoC = 不存在漏洞；影响没落地到链路终局 = 不写报告。P3 以下不写。

---

## 分层验证门（成稿前必过，本 skill 自带完整判据）

> 分两层：**硬门**（所有漏洞必过，缺一不报）+ **按类型命门**（不同类型的"关键钥匙"）+ **质量项**（尽力，不卡报告）。
> **同源同步律（2026-10-31 立）**：本节若与内部总档同源双拷，改任一处必同步另一处——两处判决漂移=审核口径分裂。

### 硬门（所有漏洞必过，缺一不报）

Read the full skill on GitHub

Details

Skill name: report
Repository: v-yun/vuln-report-skill
License: MIT
Repo updated: 31 October 2026

FAQ

What does the Report skill do?

How do I install the Report skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add v-yun/vuln-report-skill --skill report. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Report popular?

It lives in v-yun/vuln-report-skill, which has 87 GitHub stars and 4 forks.

Related skills

Pakco HTML

pakco77/pakco-html

Creates HTML decks, webpages, and social cards with pakco.html templates. Use for slides, PPT-style reports, visual web pages, or the style picker.

Documents & Office Files

Resumify

breaker505/resumify

Transform any internship experience into resume-ready, interview-ready expressions — for all roles: dev, product, operations, design, sales, finance.

Documents & Office Files

PDF Translate

lxsssssss/pdf-translate

Use when translating PDF documents between languages while strictly preserving original layout, formatting, typography, tables, and signatures. Powered by LLM direct comprehension, two-stage data-contract translation, chunked modular generation, in-browser JS overflow detection, and high-fidelity vector PDF reconstruction. Features zero-hallucination guardrails and automated 1:1 page-by-page audit script (audit_pdf.py).

Documents & Office Files

HTML Resume Builder

KevinYoung-Kw/vibe-resume-skill

Build one-page HTML/PDF resumes from copy-paste YAML using one of 12 official templates. HARD GATES: deliver exactly one A4 page; never invent a layout — copy assets/templates/<id> into output/<id>/ and edit that copy only. Keep a full inventory in raw.data.yaml. For each job, COPY selected entries into resume.data.yaml (polish there), then apply that file to a template. Apply pasted YAML by replacing visible text in the official resume.html, then run QA. Default template is basic-a4. Use when creating, iterating, polishing copy, migrating, exporting, or designing resume/CV HTML/PDF. For polis

Documents & Office Files

Many Ppt Skills

brycewang-stanford/many-ppt-skills

Pick an AI slide-deck skill and a concrete visual style from a curated registry, filtering on the requirements that decide it — editable in PowerPoint, speaker notes, a mandated corporate template, offline, PDF — with sample imagery and the style ids each project actually uses. Use when the user wants to make a presentation, deck or slides and has not already chosen a tool; asks which slide skill to use or what the difference between them is; wants to know what a style looks like before committing; or names a style id such as soft-editorial or swiss-grid. This skill routes to the skill that ma

Documents & Office Files10

Travel Guidebook

geekjourneyx/travel-guidebook

Create beautifully designed travel guidebook PDFs from trip itineraries. End-to-end workflow from deep research to Playwright PDF export, featuring zero AI-generated images, Tabler Icons, inline SVG decorations, and Claude's warm parchment aesthetic. Use this skill whenever the user mentions 路书, 旅行指南, travel guidebook, 行程手册, trip planner, 自驾游攻略, itinerary book, 攻略, 出行指南, 旅行计划, 行程规划, or wants to turn trip notes into a printable guide. Also triggers for multi-day travel planning, route guides, road trip planners, 旅行攻略制作, 旅行PDF, or converting travel research into a professionally designed documen

Documents & Office Files

Browse the most popular Claude skills, all documents & office files skills, or write your own with the skills generator.