GitHub - v-yun/vuln-report-skill 的官网地址是什么？

GitHub - v-yun/vuln-report-skill 的官方网址是：https://github.com/v-yun/vuln-report-skill

GitHub - v-yun/vuln-report-skill 属于哪个分类？

GitHub - v-yun/vuln-report-skill 属于「AI智能 / AI工具」分类。

安全搜 AQSOU.COM

网站名称

GitHub - v-yun/vuln-report-skill

网址 https://github.com/v-yun/vuln-report-skill

分类 AI智能 / AI工具预判分类安全工具

网站介绍

该项目是一个Claude Code技能，帮助安全研究人员将确认的漏洞快速生成符合SRC/0day提交要求的DOCX报告。内置分层验证门、步骤式PoC指导和截图规范，提升漏洞提交效率与规范性。

备注说明

report — Submission-Ready Vulnerability Reports (Claude Code Skill)

English | 中文 ---

工作流程 / Workflow

mermaid
flowchart TD
    A0["挖掘中遇到信号"] --> A1{"⓪ 信号快筛<br/>止损 / 待验证 / 候选"}
    A1 -->|"明显不够格"| A2["当场止损，不烧 token 深挖"]
    A1 -->|"候选漏洞"| A["验证确认（有 PoC、打到真实危害）"]
    A --> B["触发：/report 或「写报告」"]
    B --> C{"① 查重<br/>同资产+同根因+同接口+同影响面?"}
    C -->|"撞车"| C1["不新写 → 补强旧报告 / 换资产"]
    C -->|"无重复"| D{"② 分层验证门<br/>硬门 + 类型命门"}
    D -->|"硬门缺一"| D1["打回继续验证，不允许开写"]
    D -->|"全过"| E["③ 生成 DOCX<br/>章节骨架 + Step 式 PoC + 真实截图"]
    E --> F["④ 语义化命名 + 归档"]
    F --> G{"平台审核"}
    G -->|"驳回"| H["⑤ 底部追加申诉证据（不重写）"]
    G -->|"通过"| I["收录 ✓"]

效果预览 / Demo

> 演示对象为虚构靶标 demo-shop.example，仅展示生成报告的版式与结构；第 3 张为公共靶场（AltoroJ / demo.testfire.net）实拍，演示真实浏览器渲染页的嵌入效果。 > Demo uses a fictional target to showcase the layout of generated reports; page 3 is a real browser capture from a public practice target, showing how rendered pages are embedded. | 报告首页（章节骨架） | PoC 步骤页（Step + 请求块 + JSON 截图） | PoC 步骤页（真实浏览器渲染截图） | |---|---|---| | !demo page 1 | !demo page 2 | !demo page 3 | ---

English

A Claude Code skill that turns confirmed vulnerabilities into submission-ready DOCX reports for SRC (Security Response Center) and 0day platforms. It doesn't find vulnerabilities — it makes sure the report is good enough to survive review.

What it enforces

Two-stage review: a lightweight signal triage runs while digging (stop-loss on dead ends before burning tokens on verification) + full layered verification gates before writing (hard gates: reproducible PoC / impact driven to the final harm / server-side confirmation / falsification tests; per-type criteria for data leak, IDOR, RCE, SSRF, injection; 0day acceptance gates). No gate, no report — this filters out "signal ≠ vulnerability" garbage at the source.
Dual readability standard: a product manager can reproduce it step by step; a security engineer finds it technically solid. Both or rework.
Fixed DOCX layout: template.docx ships all styles (Heading 2 sections, uniform black, linear plain document), generated section by section with python-docx.
Step-style PoC spec: every step = one-line title + context + raw HTTP request block copied from any proxy tool (Burp / Yakit / mitmproxy — no curl) + conclusion + real screenshot.
Screenshot ironclad rule: every step needs a real screenshot from the live target; fabricated renders are forbidden. Captures run fully in the background (headless / CDP) — no browser or proxy window is ever yanked to the foreground. Packet evidence is embedded as raw text blocks; if the proxy UI is screenshotted, it must be the request/response detail pane, never the history list.
Anti-AI-tone rules: kills template phrasing, filler words, and boilerplate — platform reviewers use AI detection plus human intuition, and template-tone reports get downgraded.
Full workflow: dedup check → gates → DOCX generation → semantic naming → archiving → update-vs-appeal handling → cleanup.

Install

Copy the directory into Claude Code's skills directory:

bash
project-level

cp -r vuln-report-skill <your-project>/.claude/skills/report

or user-level (global)

cp -r vuln-report-skill ~/.claude/skills/report

SKILL.md and template.docx must stay in the same directory.

Usage

Once a vulnerability is verified, just say:

/report

or "写报告 / 出报告 / 成稿 / 生成漏洞报告". The skill triggers automatically and runs gates → layout → workflow end to end.

Requirements

python-docx: pip install python-docx
Screenshots — the AI can only capture screenshots if it has a browser tool. At startup the skill auto-detects available browser MCPs (Playwright / chrome-devtools / Puppeteer / etc.) and uses whatever it finds, capturing in the background without stealing window focus. If none:

- Auto (recommended): give Claude Code a browser MCP, e.g. Playwright: claude mcp add playwright -- npx @playwright/mcp@latest. The AI then opens original URLs and captures each step itself. - Manual fallback: if you don't install one, the skill switches to asking you to save each step's screenshot into shots/ — it embeds them for you. It will never fabricate a render or silently skip a screenshot. - shots/ is temporary: images are embedded into the DOCX, and the folder is deleted when the report is finished.

Notes

The skill body (SKILL.md) is written in Chinese because the target platforms (Chinese SRCs, CNVD/CNNVD, EDUSRC) require Chinese reports. The methodology — verification gates, per-type criteria, PoC structure, anti-AI-tone rules — is language-agnostic.
What it refuses to write: signals without proven end-to-end harm, your-own-test-account data, below-P3 findings, CORS/security-header non-issues. The gate blocks them and tells you why.

---