vuln-report
Draft a single-vulnerability report in GitHub advisory style from an audit finding, bug note, patch diff, PoC, or code review evidence. Use when the agent needs to turn one confirmed security issue into a clean disclosure-ready report with Summary, Details, Root Cause, Proof of Concept, Impact, embedded code snippets, explanatory prose that points to the vulnerable code, inline GitHub markdown links to source evidence, and clearly-scoped optional sections such as CWE, CVSS, references, attack preconditions, or patch metadata.
Profile →npx skills add waybarrios/opencode-power-pack --skill vuln-report --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Vulnerability Report ## Overview Draft one disclosure-ready report for one confirmed bug. Keep the report evidence-driven, concrete, and concise. Prefer the section order and phrasing rules in [references/report-template.md](references/report-template.md). ## Workflow 1. Confirm the report is about one bug only. 2. Extract the minimum facts needed to prove the issue: - vulnerable component or behavior - attacker-controlled input or missing validation - preconditions and trust boundary - exploit result - practical impact - strongest reproduction path - decisive source locations and any relevant fix commit 3. Separate demonstrated facts from inference. State assumptions explicitly. 4. Draft the report using the required section order from [references/report-template.md](references/report-template.md). 5. Always embed at least one fenced code snippet from the decisive code path, and explain what each snippet proves. 6. Always convert repository file references and patch references into GitHub markdown links, and prefer embedding those links directly into the surrounding explanation instead of listing them separately. 7. Add only the optional sections that materially improve accuracy
- Overview
- Workflow
- Required Sections
- Evidence Rules
- Self-Contained Rule
- Section Rules
- Summary
- Details
- Root Cause
- Proof of Concept (PoC)
- Impact
- Optional Sections
- Quality Bar
What does the vuln-report skill do?
Draft a single-vulnerability report in GitHub advisory style from an audit finding, bug note, patch diff, PoC, or code review evidence. Use when the agent needs to turn one confirmed security issue into a clean disclosure-ready report with Summary, Details, Root Cause, Proof of Concept, Impact, embedded code snippets, explanatory prose that points to the vulnerable code, inline GitHub markdown links to source evidence, and clearly-scoped optional sections such as CWE, CVSS, references, attack preconditions, or patch metadata.
How do I install it?
Run `npx skills add waybarrios/opencode-power-pack --skill vuln-report --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From waybarrios/opencode-power-pack, a repository with 443 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.