AI-Assisted Report Formatter

Here at Inspectiv, we have created an AI assisted tool which will help you get your report triaged and paid out faster! Point it at your vulnerability report (“Finding”) and it produces a report in our team’s preferred and required format. It works with Claude, ChatGPT, and any other assistant you already use. It only formats what you already give it - this is important. It can't verify your findings, prove any impact you didn't prove, or turn a weak bug into a strong one - so please read what it produces before you send it. 

Download Link: report_builder.zip

This is a harness skill: it loads from a local skills directory, not through the Claude/Codex app's skill uploader, so don't try to upload the .zip in the web/desktop UI.

Unzip report_builder.zip and drop the resulting report_builder/ folder (which contains SKILL.md plus its supporting files) into your agent's skills directory:

• ~/.claude/skills/ for Claude Code

• ~/.codex/skills/ for Codex

• or the equivalent path your harness reads skills from.

Restart or reload the agent, then confirm it's loaded by asking it to list available skills. Any harness that reads a folder-per-skill with a SKILL.md at its root will work the same way.

To use it, simply prompt “Use the report-builder skill to re-write this report with our in-house concise style”

This is the change we most need from you. We're seeing more reports in which the whole finding sits inside a Python file, a bash script, or a wall of chained curl commands. To read one, our team has to code-review an unknown script before we can tell what the bug is.

Instead, write reproduction steps a human can follow: numbered, in order, with the actual request and the actual response. If a script adds something, attach it as a supplement. It doesn't replace the writeup.

• Vulnerabilities packaged as scripts instead of readable reproduction steps

• Findings with no working proof of concept: theoretical impact, scanner output, "this could allow…"

• Dramatically over inflated Severity ratings your PoC doesn't demonstrate

• Out-of-scope reports: assets or issue classes the program excludes

• High-volume spam submitting

• Hostile or pushy behavior toward triage staff

• Unedited AI output submitted as a report (AI slop)

3. Final thoughts

Easy to reproduce means easy to follow. AI assistants over-explain technical mechanics, CVSS breakdowns, authentication architecture theory, parser behavior, encoding rational , and others. If your reproduction already shows the impact (you read the file, the credentials came back), the proof speaks for itself. Use whatever tools you want, including AI. We don't police tooling and we're not going to start. If the report is wrong, unverified, or unreadable, your name is on it, and "the model wrote it" isn't a defense.

Happy hunting ahead!

— The Inspectiv Team