[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AECZSCSS8TWHXT46TQHRS8":3,"skill-same:01M6AECZSCSS8TWHXT46TQHRS8":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":27,"linkOnly":28,"markdownContent":29,"markdownBody":30,"frontMatter":31,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":38,"ownerHtmlUrl":39,"ownerBlogUrl":40,"ownerDescription":41,"updatedAt":42,"install":43,"resources":56},"01M6AECZSCSS8TWHXT46TQHRS8","report-templates",null,"CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest reports","mukul975\u002FThreatswarm","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6AEC80XRNP52E8VQYCMGGZ1",98,"MIT","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Freport-templates\u002FSKILL.md",[],[19,20,21,22,23,24,25,26],"report","templates","report templates","executive summary","vector","examples","cvss","remediation","2026-11-10 10:12:30",false,"---\nname: report-templates\ndescription: CVSS 3.1 vector examples, executive summary template, full technical finding template, and remediation language bank for pentest reports\nallowed-tools: Read\n---\n\n## CVSS 3.1 Vector Reference\n\n### Format\n```\nCVSS:3.1\u002FAV:[N|A|L|P]\u002FAC:[L|H]\u002FPR:[N|L|H]\u002FUI:[N|R]\u002FS:[U|C]\u002FC:[N|L|H]\u002FI:[N|L|H]\u002FA:[N|L|H]\n```\n\n### Score by Severity Tier\n\n| Severity | Score Range | Typical Vector Example | Score |\n|---|---|---|---|\n| CRITICAL | 9.0–10.0 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H` | 9.8 |\n| CRITICAL | 9.0–10.0 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:H` | 10.0 |\n| HIGH | 7.0–8.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H` | 8.8 |\n| HIGH | 7.0–8.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N` | 7.5 |\n| HIGH | 7.0–8.9 | `CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H` | 7.8 |\n| MEDIUM | 4.0–6.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N` | 6.5 |\n| MEDIUM | 4.0–6.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N` | 5.4 |\n| MEDIUM | 4.0–6.9 | `CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N` | 5.9 |\n| LOW | 0.1–3.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N` | 4.3 |\n| LOW | 0.1–3.9 | `CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N` | 2.5 |\n| INFO | 0.0 | N\u002FA — informational only | 0.0 |\n\n### Pre-built Vectors by Vulnerability Type\n\n```\nPre-auth RCE (internet-facing):  AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 9.8\nPost-auth RCE (authenticated):   AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 8.8\nSQLi (data exfil possible):      AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 8.1\nSQLi (read-only):                AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 6.5\nStored XSS (unauthenticated):    AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 6.1\nStored XSS (post-auth):         AV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 5.4\nReflected XSS:                   AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 6.1\nSSRF (internal access):         AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 7.2\nSSRF (cloud metadata):          AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:N  = 9.6\nPath traversal (file read):      AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 7.5\nLPE (local exploit):            AV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 7.8\nInsecure deserialization:        AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 8.1\nIDOR (sensitive data):          AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 6.5\nIDOR (data modification):       AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 8.1\nAuth bypass (admin access):      AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 9.1\nWeak JWT (crackable secret):    AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 7.4\nHardcoded credentials:           AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 9.1\nOpen redirect:                   AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 6.1\nDirectory listing:               AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N  = 5.3\nInformation disclosure:          AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N  = 5.3\nMissing HTTPS:                   AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N  = 4.8\nCSRF (state-changing):          AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N  = 6.5\n```\n\n---\n\n## Executive Summary Template (1 Page)\n\n```markdown\n## Executive Summary\n\n[CLIENT NAME] engaged [FIRM NAME] to conduct a [TYPE: internal\u002Fexternal\u002Fweb application\u002Ffull-scope]\npenetration test of [SCOPE DESCRIPTION] between [START DATE] and [END DATE].\n\n### Risk Posture\n\nDuring the assessment, [FIRM NAME] identified **[N] findings** across [M] systems,\nincluding **[X] Critical**, **[Y] High**, **[Z] Medium**, **[W] Low**, and **[V] Informational** vulnerabilities.\n\nThe overall risk posture is assessed as: **[CRITICAL | HIGH | MEDIUM | LOW]**\n\n### Key Findings\n\nThe most significant finding was **[FINDING TITLE]**, which allowed testers to [IMPACT DESCRIPTION —\ne.g., \"gain unauthenticated remote code execution on the production API server and access\nthe customer database containing [N] records\"].\n\nAdditional critical findings included:\n- **[Finding 2]**: [One-sentence impact]\n- **[Finding 3]**: [One-sentence impact]\n\n### Business Impact\n\nExploitation of the identified vulnerabilities could result in:\n- Unauthorized access to sensitive customer data (regulatory impact: GDPR, PCI-DSS)\n- Complete compromise of [SYSTEM] infrastructure\n- Reputational damage and loss of customer trust\n- [SPECIFIC DOLLAR\u002FOPERATIONAL IMPACT IF QUANTIFIABLE]\n\n### Remediation Priority\n\n| Priority | Timeline | Actions |\n|----------|----------|---------|\n| Immediate (0-7 days) | Patch [CVE], revoke [credential], disable [service] |\n| Short-term (8-30 days) | Implement [control], remediate [N] High findings |\n| Medium-term (31-90 days) | Address [N] Medium findings, establish [process] |\n\n[FIRM NAME] is available to provide remediation guidance and conduct a retest upon completion.\n```\n\n---\n\n## Technical Finding Template\n\n```markdown\n---\n\n## [ID]: [SEVERITY] — [Vulnerability Title]\n\n| Field | Value |\n|-------|-------|\n| **Severity** | CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW \u002F INFO |\n| **CVSS 3.1 Score** | [SCORE] ([CVSS:3.1\u002FAV:...\u002F...]) |\n| **CWE** | CWE-[NUMBER]: [NAME] |\n| **ATT&CK TTP** | [T-NUMBER]: [TECHNIQUE NAME] |\n| **Affected Asset** | [IP \u002F URL \u002F Component] |\n| **CVE** | CVE-XXXX-XXXXX (if applicable) |\n| **Date Identified** | [UTC DATE] |\n\n### Description\n\n[2-4 sentence technical description of the vulnerability. Explain what it is, why it exists,\nand what conditions allow it to be exploited. Avoid jargon that a non-technical reader\ncannot follow in the executive summary.]\n\n### Business Impact\n\n[1-2 sentences describing the business consequence if this vulnerability is exploited.\nFrame in terms of data confidentiality, regulatory requirements, operational availability,\nor financial impact.]\n\n### Steps to Reproduce\n\n**Prerequisites:** [Access level required, e.g., \"Unauthenticated\" \u002F \"Valid user account\"]\n\n1. Navigate to `[URL]` using a web browser or send the following request:\n   ```http\n   [REQUEST METHOD] [PATH] HTTP\u002F1.1\n   Host: [HOST]\n   [HEADERS]\n\n   [BODY IF APPLICABLE]\n   ```\n\n2. [Step 2 description]\n\n3. The application responds with:\n   ```\n   [RESPONSE SNIPPET or COMMAND OUTPUT]\n   ```\n\n4. [Step describing the impact demonstration]\n\n### Evidence\n\n- **Screenshot\u002FOutput**: `evidence\u002F[DATE]\u002F[TARGET]\u002F[category]\u002F[filename]`\n- **Request\u002FResponse**: `evidence\u002F[DATE]\u002F[TARGET]\u002F[category]\u002F[filename].http`\n- **Video recording**: `evidence\u002F[DATE]\u002F[TARGET]\u002F[category]\u002F[filename].mp4` (if captured)\n\n### Remediation\n\n**Immediate Actions:**\n1. [Specific immediate mitigation step — e.g., \"Disable the affected endpoint at the WAF layer\"]\n2. [Second immediate step if needed]\n\n**Long-term Fix:**\n[Specific code-level or configuration-level remediation. Include version number to upgrade to,\nconfiguration value to set, or code pattern to implement.]\n\n**Verification:**\n[How to confirm the fix is effective — e.g., \"Re-run the proof of concept steps above;\nthe server should return HTTP 403 or equivalent error.\"]\n\n### References\n\n- [CVE link or NVD URL if applicable]\n- [Vendor advisory URL]\n- [OWASP \u002F CWE \u002F NIST link]\n- [ATT&CK technique URL: https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT-NUMBER\u002F]\n```\n\n---\n\n## 5×5 Risk Matrix\n\n```markdown\n## Risk Matrix\n\n|  | **Negligible (1)** | **Minor (2)** | **Moderate (3)** | **Major (4)** | **Catastrophic (5)** |\n|---|---|---|---|---|---|\n| **Almost Certain (5)** | MEDIUM 5 | HIGH 10 | HIGH 15 | CRITICAL 20 | CRITICAL 25 |\n| **Likely (4)** | LOW 4 | MEDIUM 8 | HIGH 12 | HIGH 16 | CRITICAL 20 |\n| **Possible (3)** | LOW 3 | MEDIUM 6 | MEDIUM 9 | HIGH 12 | HIGH 15 |\n| **Unlikely (2)** | LOW 2 | LOW 4 | MEDIUM 6 | MEDIUM 8 | HIGH 10 |\n| **Rare (1)** | INFO 1 | LOW 2 | LOW 3 | LOW 4 | MEDIUM 5 |\n\n*Score = Likelihood × Impact*\n```\n\n---\n\n## Remediation Language Bank (Top 20 Vulnerability Types)\n\n### SQL Injection\n> Implement parameterized queries (prepared statements) for all database interactions.\n> Do not construct SQL queries using string concatenation with user-supplied input.\n> Apply input validation with allowlists at the application layer. Deploy a WAF rule\n> to detect and block common SQL injection patterns as a defense-in-depth measure.\n\n### Cross-Site Scripting (XSS)\n> Implement context-sensitive output encoding for all user-controlled data rendered in HTML,\n> JavaScript, CSS, and URL contexts. Use a Content Security Policy (CSP) header that restricts\n> inline scripts and specifies trusted sources. Validate and sanitize all inputs using an\n> allowlist approach. Consider adopting a templating framework that auto-escapes by default.\n\n### Insecure Direct Object Reference (IDOR)\n> Implement server-side authorization checks that verify the authenticated user has permission\n> to access the requested object before returning it. Replace sequential numeric IDs with\n> unpredictable UUIDs where possible. Do not rely solely on obscurity — enforce access controls\n> regardless of whether the ID is guessable.\n\n### Server-Side Request Forgery (SSRF)\n> Validate and allowlist permitted URL schemes, hosts, and ports before making server-side\n> requests. Block requests to RFC 1918 private address ranges, loopback (127.0.0.1), and\n> cloud metadata endpoints (169.254.169.254). Use a dedicated network egress proxy and\n> disable URL redirects when making outbound connections.\n\n### Broken Authentication \u002F Auth Bypass\n> Implement strong multi-factor authentication. Enforce secure session management: use\n> cryptographically random session IDs, set Secure and HttpOnly cookie flags, expire sessions\n> after inactivity, and invalidate server-side on logout. Audit all authentication code paths\n> for logic bypasses including parameter manipulation, host header injection, and JWT algorithm confusion.\n\n### Insecure File Upload\n> Validate file type using magic byte inspection (not just extension). Enforce maximum file\n> size limits. Store uploaded files outside the web root with non-executable permissions.\n> Serve files through a separate subdomain without CGI\u002FPHP processing enabled.\n> Scan uploaded files with an antivirus engine before processing.\n\n### Command Injection\n> Never pass user input to shell interpreters. Redesign functionality to avoid subprocess\n> calls where possible; if unavoidable, use language-native API bindings that do not invoke\n> a shell, and apply strict allowlist validation on all parameters.\n\n### Path Traversal\n> Resolve the canonical path after user input is appended to the base directory and verify\n> the result starts with the expected base path before accessing the file. Never pass\n> user-controlled input directly to file system APIs.\n\n### Insecure Deserialization\n> Avoid deserializing data from untrusted sources. If required, use a data format that\n> does not support arbitrary object deserialization (JSON\u002FXML rather than Java Serialization,\n> PHP unserialize, or Python pickle). Implement integrity checking (HMAC) on serialized data\n> and apply an allowlist of permitted classes during deserialization.\n\n### Sensitive Data Exposure\n> Encrypt sensitive data at rest using AES-256 and in transit using TLS 1.2+ with HSTS.\n> Remove sensitive data from responses, logs, and error messages. Apply field-level\n> encryption for PII. Implement data classification and enforce access controls\n> at the data layer, not just the application layer.\n\n### Security Misconfiguration\n> Apply CIS benchmarks to all systems, containers, and cloud services. Remove default\n> credentials, sample applications, and unnecessary services. Automate configuration\n> baseline enforcement using infrastructure-as-code tools (Terraform, Ansible)\n> and validate continuously with configuration scanning tools.\n\n### XML External Entity (XXE)\n> Disable XML external entity processing in the XML parser configuration.\n> In Java: `factory.setFeature(\"http:\u002F\u002Fxml.org\u002Fsax\u002Ffeatures\u002Fexternal-general-entities\", false)`.\n> In PHP: `libxml_disable_entity_loader(true)`. Use less complex data formats (JSON)\n> where XML is not required.\n\n### Missing Rate Limiting \u002F Brute Force\n> Implement account lockout after N (5–10) failed authentication attempts with\n> progressive delay. Apply IP-based rate limiting at the application gateway layer.\n> Enable CAPTCHA for high-value authentication flows. Log and alert on abnormal\n> login velocity from a single source.\n\n### Hardcoded Credentials\n> Remove all hardcoded credentials from source code, configuration files, and\n> container images immediately. Rotate any exposed credentials. Store secrets in\n> a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault).\n> Implement pre-commit hooks and CI pipeline scanning (gitleaks, truffleHog) to\n> prevent future credential exposure.\n\n### JWT Vulnerabilities\n> Validate the `alg` header against an allowlist of accepted algorithms; reject `none`.\n> Use asymmetric keys (RS256\u002FES256) rather than symmetric HMAC. Validate `iss`, `aud`,\n> `exp`, and `nbf` claims on every request. Use a minimum 256-bit secret for HS256.\n> Rotate signing keys periodically.\n\n### CSRF\n> Implement anti-CSRF tokens (synchronizer token pattern) for all state-changing requests.\n> Use the SameSite=Strict or SameSite=Lax cookie attribute. Validate the Origin and Referer\n> headers server-side. For REST APIs, verify the Content-Type is application\u002Fjson\n> (non-simple CORS request) to leverage the preflight mechanism.\n\n### Open Redirect\n> Validate redirect URLs against a strict allowlist of permitted destinations.\n> Reject any URL that does not match the expected domain exactly. Do not rely\n> on URL parsing alone — canonicalize and normalize the URL before comparison.\n\n### Directory Listing\n> Disable directory listing in the web server configuration.\n> Apache: `Options -Indexes`. Nginx: remove `autoindex on`. Ensure that\n> all directories accessible via the web root contain an index document or\n> are explicitly denied.\n\n### Unpatched Software \u002F Known CVEs\n> Establish a vulnerability management program with defined SLAs by severity\n> (Critical: 24h, High: 7 days, Medium: 30 days, Low: 90 days). Deploy\n> authenticated vulnerability scanning weekly. Enroll in vendor security advisories\n> and subscribe to the CISA Known Exploited Vulnerabilities (KEV) catalog.\n\n### Insecure TLS Configuration\n> Enforce TLS 1.2 as the minimum version; prefer TLS 1.3. Disable weak cipher suites\n> (RC4, DES, 3DES, export ciphers, NULL). Enable HSTS with a minimum max-age of 31536000\n> and include the `preload` directive. Configure OCSP stapling. Use a certificate with\n> a minimum 2048-bit RSA or 256-bit ECDSA key signed by a trusted CA.\n\n---\n\n## 30\u002F60\u002F90 Remediation Roadmap Template\n\n```markdown\n## Remediation Roadmap\n\n### Phase 1: Immediate (Days 1–30)\n**Goal:** Eliminate critical\u002Fhigh risk and contain active exposure\n\n| # | Finding | Owner | Action | Due |\n|---|---------|-------|--------|-----|\n| 1 | [CRITICAL finding] | [Team] | [Specific action] | Day 7 |\n| 2 | [HIGH finding] | [Team] | [Specific action] | Day 14 |\n| 3 | [HIGH finding] | [Team] | [Specific action] | Day 30 |\n\n### Phase 2: Short-term (Days 31–60)\n**Goal:** Address medium-severity findings and implement preventive controls\n\n| # | Finding | Owner | Action | Due |\n|---|---------|-------|--------|-----|\n| 1 | [MEDIUM finding] | [Team] | [Specific action] | Day 45 |\n| 2 | [MEDIUM finding] | [Team] | [Specific action] | Day 60 |\n\n### Phase 3: Medium-term (Days 61–90)\n**Goal:** Harden security program and address low-severity findings\n\n| # | Finding | Owner | Action | Due |\n|---|---------|-------|--------|-----|\n| 1 | [LOW finding] | [Team] | [Specific action] | Day 75 |\n| 2 | [Program improvement] | [Security team] | [Specific action] | Day 90 |\n\n**Retest:** A verification assessment is recommended upon completion of Phase 1.\n```\n","## CVSS 3.1 Vector Reference\n\n### Format\n```\nCVSS:3.1\u002FAV:[N|A|L|P]\u002FAC:[L|H]\u002FPR:[N|L|H]\u002FUI:[N|R]\u002FS:[U|C]\u002FC:[N|L|H]\u002FI:[N|L|H]\u002FA:[N|L|H]\n```\n\n### Score by Severity Tier\n\n| Severity | Score Range | Typical Vector Example | Score |\n|---|---|---|---|\n| CRITICAL | 9.0–10.0 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H` | 9.8 |\n| CRITICAL | 9.0–10.0 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:H` | 10.0 |\n| HIGH | 7.0–8.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H` | 8.8 |\n| HIGH | 7.0–8.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N` | 7.5 |\n| HIGH | 7.0–8.9 | `CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H` | 7.8 |\n| MEDIUM | 4.0–6.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N` | 6.5 |\n| MEDIUM | 4.0–6.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N` | 5.4 |\n| MEDIUM | 4.0–6.9 | `CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N` | 5.9 |\n| LOW | 0.1–3.9 | `CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N` | 4.3 |\n| LOW | 0.1–3.9 | `CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N` | 2.5 |\n| INFO | 0.0 | N\u002FA — informational only | 0.0 |\n\n### Pre-built Vectors by Vulnerability Type\n\n```\nPre-auth RCE (internet-facing):  AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 9.8\nPost-auth RCE (authenticated):   AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 8.8\nSQLi (data exfil possible):      AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 8.1\nSQLi (read-only):                AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 6.5\nStored XSS (unauthenticated):    AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 6.1\nStored XSS (post-auth):         AV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 5.4\nReflected XSS:                   AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 6.1\nSSRF (internal access):         AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 7.2\nSSRF (cloud metadata):          AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:H\u002FA:N  = 9.6\nPath traversal (file read):      AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 7.5\nLPE (local exploit):            AV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 7.8\nInsecure deserialization:        AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H  = 8.1\nIDOR (sensitive data):          AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N  = 6.5\nIDOR (data modification):       AV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 8.1\nAuth bypass (admin access):      AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 9.1\nWeak JWT (crackable secret):    AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 7.4\nHardcoded credentials:           AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N  = 9.1\nOpen redirect:                   AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N  = 6.1\nDirectory listing:               AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N  = 5.3\nInformation disclosure:          AV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N  = 5.3\nMissing HTTPS:                   AV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N  = 4.8\nCSRF (state-changing):          AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N  = 6.5\n```\n\n---\n\n## Executive Summary Template (1 Page)\n\n```markdown\n## Executive Summary\n\n[CLIENT NAME] engaged [FIRM NAME] to conduct a [TYPE: internal\u002Fexternal\u002Fweb application\u002Ffull-scope]\npenetration test of [SCOPE DESCRIPTION] between [START DATE] and [END DATE].\n\n### Risk Posture\n\nDuring the assessment, [FIRM NAME] identified **[N] findings** across [M] systems,\nincluding **[X] Critical**, **[Y] High**, **[Z] Medium**, **[W] Low**, and **[V] Informational** vulnerabilities.\n\nThe overall risk posture is assessed as: **[CRITICAL | HIGH | MEDIUM | LOW]**\n\n### Key Findings\n\nThe most significant finding was **[FINDING TITLE]**, which allowed testers to [IMPACT DESCRIPTION —\ne.g., \"gain unauthenticated remote code execution on the production API server and access\nthe customer database containing [N] records\"].\n\nAdditional critical findings included:\n- **[Finding 2]**: [One-sentence impact]\n- **[Finding 3]**: [One-sentence impact]\n\n### Business Impact\n\nExploitation of the identified vulnerabilities could result in:\n- Unauthorized access to sensitive customer data (regulatory impact: GDPR, PCI-DSS)\n- Complete compromise of [SYSTEM] infrastructure\n- Reputational damage and loss of customer trust\n- [SPECIFIC DOLLAR\u002FOPERATIONAL IMPACT IF QUANTIFIABLE]\n\n### Remediation Priority\n\n| Priority | Timeline | Actions |\n|----------|----------|---------|\n| Immediate (0-7 days) | Patch [CVE], revoke [credential], disable [service] |\n| Short-term (8-30 days) | Implement [control], remediate [N] High findings |\n| Medium-term (31-90 days) | Address [N] Medium findings, establish [process] |\n\n[FIRM NAME] is available to provide remediation guidance and conduct a retest upon completion.\n```\n\n---\n\n## Technical Finding Template\n\n```markdown\n---\n\n## [ID]: [SEVERITY] — [Vulnerability Title]\n\n| Field | Value |\n|-------|-------|\n| **Severity** | CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW \u002F INFO |\n| **CVSS 3.1 Score** | [SCORE] ([CVSS:3.1\u002FAV:...\u002F...]) |\n| **CWE** | CWE-[NUMBER]: [NAME] |\n| **ATT&CK TTP** | [T-NUMBER]: [TECHNIQUE NAME] |\n| **Affected Asset** | [IP \u002F URL \u002F Component] |\n| **CVE** | CVE-XXXX-XXXXX (if applicable) |\n| **Date Identified** | [UTC DATE] |\n\n### Description\n\n[2-4 sentence technical description of the vulnerability. Explain what it is, why it exists,\nand what conditions allow it to be exploited. Avoid jargon that a non-technical reader\ncannot follow in the executive summary.]\n\n### Business Impact\n\n[1-2 sentences describing the business consequence if this vulnerability is exploited.\nFrame in terms of data confidentiality, regulatory requirements, operational availability,\nor financial impact.]\n\n### Steps to Reproduce\n\n**Prerequisites:** [Access level required, e.g., \"Unauthenticated\" \u002F \"Valid user account\"]\n\n1. Navigate to `[URL]` using a web browser or send the following request:\n   ```http\n   [REQUEST METHOD] [PATH] HTTP\u002F1.1\n   Host: [HOST]\n   [HEADERS]\n\n   [BODY IF APPLICABLE]\n   ```\n\n2. [Step 2 description]\n\n3. The application responds with:\n   ```\n   [RESPONSE SNIPPET or COMMAND OUTPUT]\n   ```\n\n4. [Step describing the impact demonstration]\n\n### Evidence\n\n- **Screenshot\u002FOutput**: `evidence\u002F[DATE]\u002F[TARGET]\u002F[category]\u002F[filename]`\n- **Request\u002FResponse**: `evidence\u002F[DATE]\u002F[TARGET]\u002F[category]\u002F[filename].http`\n- **Video recording**: `evidence\u002F[DATE]\u002F[TARGET]\u002F[category]\u002F[filename].mp4` (if captured)\n\n### Remediation\n\n**Immediate Actions:**\n1. [Specific immediate mitigation step — e.g., \"Disable the affected endpoint at the WAF layer\"]\n2. [Second immediate step if needed]\n\n**Long-term Fix:**\n[Specific code-level or configuration-level remediation. Include version number to upgrade to,\nconfiguration value to set, or code pattern to implement.]\n\n**Verification:**\n[How to confirm the fix is effective — e.g., \"Re-run the proof of concept steps above;\nthe server should return HTTP 403 or equivalent error.\"]\n\n### References\n\n- [CVE link or NVD URL if applicable]\n- [Vendor advisory URL]\n- [OWASP \u002F CWE \u002F NIST link]\n- [ATT&CK technique URL: https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT-NUMBER\u002F]\n```\n\n---\n\n## 5×5 Risk Matrix\n\n```markdown\n## Risk Matrix\n\n|  | **Negligible (1)** | **Minor (2)** | **Moderate (3)** | **Major (4)** | **Catastrophic (5)** |\n|---|---|---|---|---|---|\n| **Almost Certain (5)** | MEDIUM 5 | HIGH 10 | HIGH 15 | CRITICAL 20 | CRITICAL 25 |\n| **Likely (4)** | LOW 4 | MEDIUM 8 | HIGH 12 | HIGH 16 | CRITICAL 20 |\n| **Possible (3)** | LOW 3 | MEDIUM 6 | MEDIUM 9 | HIGH 12 | HIGH 15 |\n| **Unlikely (2)** | LOW 2 | LOW 4 | MEDIUM 6 | MEDIUM 8 | HIGH 10 |\n| **Rare (1)** | INFO 1 | LOW 2 | LOW 3 | LOW 4 | MEDIUM 5 |\n\n*Score = Likelihood × Impact*\n```\n\n---\n\n## Remediation Language Bank (Top 20 Vulnerability Types)\n\n### SQL Injection\n> Implement parameterized queries (prepared statements) for all database interactions.\n> Do not construct SQL queries using string concatenation with user-supplied input.\n> Apply input validation with allowlists at the application layer. Deploy a WAF rule\n> to detect and block common SQL injection patterns as a defense-in-depth measure.\n\n### Cross-Site Scripting (XSS)\n> Implement context-sensitive output encoding for all user-controlled data rendered in HTML,\n> JavaScript, CSS, and URL contexts. Use a Content Security Policy (CSP) header that restricts\n> inline scripts and specifies trusted sources. Validate and sanitize all inputs using an\n> allowlist approach. Consider adopting a templating framework that auto-escapes by default.\n\n### Insecure Direct Object Reference (IDOR)\n> Implement server-side authorization checks that verify the authenticated user has permission\n> to access the requested object before returning it. Replace sequential numeric IDs with\n> unpredictable UUIDs where possible. Do not rely solely on obscurity — enforce access controls\n> regardless of whether the ID is guessable.\n\n### Server-Side Request Forgery (SSRF)\n> Validate and allowlist permitted URL schemes, hosts, and ports before making server-side\n> requests. Block requests to RFC 1918 private address ranges, loopback (127.0.0.1), and\n> cloud metadata endpoints (169.254.169.254). Use a dedicated network egress proxy and\n> disable URL redirects when making outbound connections.\n\n### Broken Authentication \u002F Auth Bypass\n> Implement strong multi-factor authentication. Enforce secure session management: use\n> cryptographically random session IDs, set Secure and HttpOnly cookie flags, expire sessions\n> after inactivity, and invalidate server-side on logout. Audit all authentication code paths\n> for logic bypasses including parameter manipulation, host header injection, and JWT algorithm confusion.\n\n### Insecure File Upload\n> Validate file type using magic byte inspection (not just extension). Enforce maximum file\n> size limits. Store uploaded files outside the web root with non-executable permissions.\n> Serve files through a separate subdomain without CGI\u002FPHP processing enabled.\n> Scan uploaded files with an antivirus engine before processing.\n\n### Command Injection\n> Never pass user input to shell interpreters. Redesign functionality to avoid subprocess\n> calls where possible; if unavoidable, use language-native API bindings that do not invoke\n> a shell, and apply strict allowlist validation on all parameters.\n\n### Path Traversal\n> Resolve the canonical path after user input is appended to the base directory and verify\n> the result starts with the expected base path before accessing the file. Never pass\n> user-controlled input directly to file system APIs.\n\n### Insecure Deserialization\n> Avoid deserializing data from untrusted sources. If required, use a data format that\n> does not support arbitrary object deserialization (JSON\u002FXML rather than Java Serialization,\n> PHP unserialize, or Python pickle). Implement integrity checking (HMAC) on serialized data\n> and apply an allowlist of permitted classes during deserialization.\n\n### Sensitive Data Exposure\n> Encrypt sensitive data at rest using AES-256 and in transit using TLS 1.2+ with HSTS.\n> Remove sensitive data from responses, logs, and error messages. Apply field-level\n> encryption for PII. Implement data classification and enforce access controls\n> at the data layer, not just the application layer.\n\n### Security Misconfiguration\n> Apply CIS benchmarks to all systems, containers, and cloud services. Remove default\n> credentials, sample applications, and unnecessary services. Automate configuration\n> baseline enforcement using infrastructure-as-code tools (Terraform, Ansible)\n> and validate continuously with configuration scanning tools.\n\n### XML External Entity (XXE)\n> Disable XML external entity processing in the XML parser configuration.\n> In Java: `factory.setFeature(\"http:\u002F\u002Fxml.org\u002Fsax\u002Ffeatures\u002Fexternal-general-entities\", false)`.\n> In PHP: `libxml_disable_entity_loader(true)`. Use less complex data formats (JSON)\n> where XML is not required.\n\n### Missing Rate Limiting \u002F Brute Force\n> Implement account lockout after N (5–10) failed authentication attempts with\n> progressive delay. Apply IP-based rate limiting at the application gateway layer.\n> Enable CAPTCHA for high-value authentication flows. Log and alert on abnormal\n> login velocity from a single source.\n\n### Hardcoded Credentials\n> Remove all hardcoded credentials from source code, configuration files, and\n> container images immediately. Rotate any exposed credentials. Store secrets in\n> a dedicated secrets manager (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault).\n> Implement pre-commit hooks and CI pipeline scanning (gitleaks, truffleHog) to\n> prevent future credential exposure.\n\n### JWT Vulnerabilities\n> Validate the `alg` header against an allowlist of accepted algorithms; reject `none`.\n> Use asymmetric keys (RS256\u002FES256) rather than symmetric HMAC. Validate `iss`, `aud`,\n> `exp`, and `nbf` claims on every request. Use a minimum 256-bit secret for HS256.\n> Rotate signing keys periodically.\n\n### CSRF\n> Implement anti-CSRF tokens (synchronizer token pattern) for all state-changing requests.\n> Use the SameSite=Strict or SameSite=Lax cookie attribute. Validate the Origin and Referer\n> headers server-side. For REST APIs, verify the Content-Type is application\u002Fjson\n> (non-simple CORS request) to leverage the preflight mechanism.\n\n### Open Redirect\n> Validate redirect URLs against a strict allowlist of permitted destinations.\n> Reject any URL that does not match the expected domain exactly. Do not rely\n> on URL parsing alone — canonicalize and normalize the URL before comparison.\n\n### Directory Listing\n> Disable directory listing in the web server configuration.\n> Apache: `Options -Indexes`. Nginx: remove `autoindex on`. Ensure that\n> all directories accessible via the web root contain an index document or\n> are explicitly denied.\n\n### Unpatched Software \u002F Known CVEs\n> Establish a vulnerability management program with defined SLAs by severity\n> (Critical: 24h, High: 7 days, Medium: 30 days, Low: 90 days). Deploy\n> authenticated vulnerability scanning weekly. Enroll in vendor security advisories\n> and subscribe to the CISA Known Exploited Vulnerabilities (KEV) catalog.\n\n### Insecure TLS Configuration\n> Enforce TLS 1.2 as the minimum version; prefer TLS 1.3. Disable weak cipher suites\n> (RC4, DES, 3DES, export ciphers, NULL). Enable HSTS with a minimum max-age of 31536000\n> and include the `preload` directive. Configure OCSP stapling. Use a certificate with\n> a minimum 2048-bit RSA or 256-bit ECDSA key signed by a trusted CA.\n\n---\n\n## 30\u002F60\u002F90 Remediation Roadmap Template\n\n```markdown\n## Remediation Roadmap\n\n### Phase 1: Immediate (Days 1–30)\n**Goal:** Eliminate critical\u002Fhigh risk and contain active exposure\n\n| # | Finding | Owner | Action | Due |\n|---|---------|-------|--------|-----|\n| 1 | [CRITICAL finding] | [Team] | [Specific action] | Day 7 |\n| 2 | [HIGH finding] | [Team] | [Specific action] | Day 14 |\n| 3 | [HIGH finding] | [Team] | [Specific action] | Day 30 |\n\n### Phase 2: Short-term (Days 31–60)\n**Goal:** Address medium-severity findings and implement preventive controls\n\n| # | Finding | Owner | Action | Due |\n|---|---------|-------|--------|-----|\n| 1 | [MEDIUM finding] | [Team] | [Specific action] | Day 45 |\n| 2 | [MEDIUM finding] | [Team] | [Specific action] | Day 60 |\n\n### Phase 3: Medium-term (Days 61–90)\n**Goal:** Harden security program and address low-severity findings\n\n| # | Finding | Owner | Action | Due |\n|---|---------|-------|--------|-----|\n| 1 | [LOW finding] | [Team] | [Specific action] | Day 75 |\n| 2 | [Program improvement] | [Security team] | [Specific action] | Day 90 |\n\n**Retest:** A verification assessment is recommended upon completion of Phase 1.\n```\n",{"name":5,"description":7,"allowed-tools":32},"Read","main","4789a8223ef5325f46a198059f56b97ff72ee26e","threatswarm-plugin\u002Fskills\u002Freport-templates",27,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-04-29 23:49:33",{"source":8,"skillName":5,"commands":44,"prompt":54,"zipAvailable":55},[45,48,51],{"tool":46,"command":47},"npx","npx skills add mukul975\u002FThreatswarm --skill report-templates",{"tool":49,"command":50},"bunx","bunx skills add mukul975\u002FThreatswarm --skill report-templates",{"tool":52,"command":53},"pnpm","pnpm dlx skills add mukul975\u002FThreatswarm --skill report-templates","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Freport-templates\u002FSKILL.md",true,[],[58,65,78,88,100,105],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":27},"01M6AED29RRH41NP7XD7FQ92R8","wordlists","SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fwordlists\u002FSKILL.md",[],[60],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":27},"01M6AECWRXDGQ0JSB5YM7PNW2B","mitre-attack","MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fmitre-attack\u002FSKILL.md",[],[72,73,74,75,76,77],"mitre attack","detection","ATT&CK","framework","documentation","writing",{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":27},"01M6AECTDPHG19MBYH3F82K173","exploit-db","Exploit-DB and searchsploit reference — EDB→Metasploit module mappings, PoC reliability rubric, CVSS tier quick reference, and searchsploit usage patterns","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fexploit-db\u002FSKILL.md",[],[85,86,25,87],"exploit db","Metasploit","quick reference",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":27},"01M6AECQPYCAMDT8BMF03GMRN6","ad-attacks","Active Directory attack reference — BloodHound Cypher queries, Kerberos attack decision tree, ACE\u002FACL abuse, ADCS ESC1-8, and AD misconfig checklist","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002Fthreatswarm-plugin\u002Fskills\u002Fad-attacks\u002FSKILL.md",[],[95,96,97,98,99],"ad attacks","kerberos","bloodhound","ACL","directory",{"skillNo":101,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":27},"01M6AECMZ0NKV20DN98DZ6ZC89","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwordlists\u002FSKILL.md",[],[60],{"skillNo":106,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":27},"01M6AECJ70MCZ4BD72TG0YK3CJ","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FThreatswarm\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Freport-templates\u002FSKILL.md",[],[19,21,20,22,23,24,26,25]]