pentest-reporterlisted

# Pentest Reporter > **Scope-only**: report output may only contain information covered by the engagement Rules of Engagement. Findings outside scope (even when noticed) go via separate side-channel communication with the customer, not into the main report without explicit sign-off. ## When to use A pentest is done when the report is on paper, not when the testing stops. This skill connects the technical work from `recon-agent`, `web-exploit-triage`, `exploit-chain`, `payload-crafter`, `ad-attacks`, and `post-exploit` to a deliverable the customer can use to fix things, show to auditors, and prioritize internally. Triggers on: - A question like "write a pentest report for engagement X", "build the exec summary", "score these findings with CVSS", "build a remediation roadmap", "retest template". - A bug-bounty submission that needs structure — lower bar than a full pentest report, same discipline. - A red-team engagement where multiple reports (technical detail + exec summary + detection-gaps report) are needed. - A retest cycle after an earlier report: per-finding sign-off plus overall attestation. - A handoff from `security-review` when a found issue needs a formal finding entry. ### When NOT (handoff) - Active exploitation or PoC building → the relevant pentest skills (`exploit-chain`, `payload-crafter`, `web-exploit-triage`, `ad-attacks`). - Internal security-review reporting (not engagement-bound) → `security-review`. Different audience, different tone. - Complianc