Reporting

Cracken produces security-assessment reports as output files that the agent writes during an operation. You download each output as PDF or Markdown when it is small enough to preview, and as the original file otherwise; you manage outputs from the operation's output panel, and attach your own template to an operation when you want a specific structure.

At a glance

What it is — security-assessment reports produced as output files the agent writes into an operation, downloadable as PDF or Markdown when they can be previewed, and as the original file otherwise.
When to use it — once an operation has findings to deliver, or beforehand to attach a custom template that controls the report's structure.
Inputs — an operation (optionally driven by a playbook); an optional custom Markdown template attached to the operation with {{placeholder}} fields.
Outputs — output files in the operation's outputs directory, downloadable individually — PDF or Markdown for a previewable Markdown output, the original file for anything too large to preview or not text — or via Download All.
Related objects — Operations, Playbooks, Cybergraph, File System.
Common actions — List, View and Edit (previewable text outputs), Download, Download All.
API / tool links — UI only — no public API.

How reports are produced

The agent writes deliverables directly into the operation's outputs directory on the Tentacle filesystem. There is no separate "generate report" button — a report is an output file the agent creates while it works:

When a playbook is in effect, the agent follows the playbook's steps, tools, and output format.
With no playbook, you ask the agent in the operation to "generate a report" (or "write a summary" / "create a document") and it writes the deliverable into the operation outputs.

Sub-operations return summaries rather than finished reports; the operation that owns the deliverable aggregates those summaries and writes the report itself.

Download an output

Open the operation, open its output files panel, and select an output. What you can do with it depends on the output:

Markdown outputs — open in an editor with PDF and MD buttons; you choose the format at download time.
Other text outputs — open in a code editor with a single Download button that saves the file as it is.
Outputs too large to preview, and binary outputs — show a Download File card that saves the original file. There is no inline view, no editing, and no format choice.

Use Download All to pull every output from the operation at once.

Manage outputs

Operations accumulate output files over their lifecycle. From the operation's output panel you can:

List all generated outputs.
View and Edit an output's content inline — for text outputs small enough to be previewed.
Download an individual output — PDF or Markdown for a previewable Markdown output, the original file otherwise — or all outputs.

Custom templates

To control a report's structure, attach a Markdown template to the operation. The agent reads the attached template at the moment it generates the report and fills the {{placeholder}} fields as it writes — there is no separate substitution step; the agent writes the content.

A playbook can also dictate the report format and template. When a playbook applies, its instructions take precedence over the default report behavior, and the agent can write other formats the playbook calls for (for example DOCX or XLSX) directly into the outputs directory.

Cybergraph traceability

Findings are not isolated text. The Cybergraph records security-relevant entities — including Vulnerability, Evidence, and Finding nodes — discovered across operations, so a report's findings can be traced back to the evidence in the graph that supports them.

Default report template

The Markdown below is a starting template for a security-assessment report. Attach your own version to an operation to change the structure; the agent fills the {{placeholder}} fields as it writes the report.

# {{Target Name}} Security Assessment

## Prepared for

**Client Name:** {{Client Name}}  
**Date of Report:** {{Date}}  
**Prepared by:** {{Your Company Name}}  
**Security Consultant:** {{Consultant Name}}, {{Consultant Title}}  
**Version:** 1.0

---

## Confidentiality Notice

This document contains confidential information intended solely for the use of **{{Client Name}}**. Unauthorized copying, distribution, or disclosure of the contents of this report is strictly prohibited.

## Disclaimer

The findings and recommendations in this report are based on the scope of work agreed upon and the information provided during the assessment period. While **{{Your Company Name}}** has made every effort to identify vulnerabilities within the agreed scope, we do not guarantee that all existing vulnerabilities have been discovered or that the environment is entirely secure. **{{Your Company Name}}** shall not be held liable for any security incidents, breaches, or damages that may occur after the assessment.

## Limitation of Liability

**{{Your Company Name}}** makes no warranties regarding the completeness or accuracy of the findings. The client assumes full responsibility for the use and implementation of the information provided. **{{Your Company Name}}** shall not be liable for any direct, indirect, incidental, or consequential damages resulting from the use of this report.

## Terms of Use

This report is intended for the exclusive use of **{{Client Name}}**.

---

## Executive Summary

### Target Description

- **Target Name:** {{Target Name}}
- **Industry:** {{Industry}}
- **Location:** {{URL or IP Address}}
- **Assessment Period:** {{Start Date}} - {{End Date}}
- **Test Type:** {{Test Type (e.g., Grey Box Web Application Penetration Test)}}

### Current Security Posture

{{Summary of the overall security posture based on findings. Describe the general state of security and highlight key concerns.}}

### Summary of Findings

- **Critical:** {{Number}}
- **High:** {{Number}}
- **Medium:** {{Number}}
- **Low:** {{Number}}
- **Informational:** {{Number}}

---

## Methodologies

### Frameworks & Standards

- OWASP Web Security Testing Guide v4.2
- OWASP Top 10 2021
- MITRE ATT&CK Framework (Enterprise)
- {{Additional frameworks as applicable}}

### Testing Activities Performed

**Reconnaissance**
- {{Activity Name}}: {{Brief description of what was done}} ({{T-code - Technique Name}})

**Resource Development**
- {{Activity Name}}: {{Brief description}} ({{T-code - Technique Name}})

**Initial Access**
- {{Activity Name}}: {{Brief description}} ({{T-code - Technique Name}})

{{Additional phases as needed}}

### OWASP Top 10 (2021) Coverage

- **A01:2021 - Broken Access Control:** {{Confirmed/Not Found - Brief description}}
- **A02:2021 - Cryptographic Failures:** {{Confirmed/Not Found - Brief description}}
- **A03:2021 - Injection:** {{Confirmed/Not Found - Brief description}}
- **A04:2021 - Insecure Design:** {{Confirmed/Not Found - Brief description}}
- **A05:2021 - Security Misconfiguration:** {{Confirmed/Not Found - Brief description}}
- **A06:2021 - Vulnerable Components:** {{Confirmed/Not Found - Brief description}}
- **A07:2021 - Auth Failures:** {{Confirmed/Not Found - Brief description}}
- **A08:2021 - Software & Data Integrity:** {{Confirmed/Not Found - Brief description}}
- **A09:2021 - Security Logging Failures:** {{Confirmed/Not Found - Brief description}}
- **A10:2021 - SSRF:** {{Confirmed/Not Found - Brief description}}

### Scope & Coverage

- **{{Area 1}}** - {{Brief description of what was tested}}
- **{{Area 2}}** - {{Brief description of what was tested}}
- **{{Area 3}}** - {{Brief description of what was tested}}

### Tools Used

`{{Tool 1}}` `{{Tool 2}}` `{{Tool 3}}` `{{Tool 4}}`

---

## Issues and Findings

### Issue #1: {{Issue Title}}

**Severity:** {{Critical/High/Medium/Low/Informational}}  
**Affected Asset:** `{{Endpoint or Component}}`  
**CVSS Score:** {{Score}}

#### Description

{{Detailed technical description of the vulnerability. Explain what was found, where it exists, and the technical context.}}

#### Evidence

**Proof of Concept:**

**Steps to Reproduce:**
1. {{Step 1}}
2. {{Step 2}}
3. {{Step 3}}

#### Impact

- {{Impact point 1}}
- {{Impact point 2}}
- {{Impact point 3}}

#### Recommendation

1. {{Remediation step 1}}
2. {{Remediation step 2}}
3. {{Remediation step 3}}

#### References

- {{Reference 1 (e.g., OWASP link, CVE, CWE)}}
- {{Reference 2}}

---

### Issue #2: {{Issue Title}}

Repeat the Issue #1 structure (Severity, Affected Asset, CVSS Score, Description, Evidence, Impact, Recommendation, References) for each additional finding.

---

## Risk Summary

- **Critical ({{Number}}):** Immediate remediation required (24-48 hours)
- **High ({{Number}}):** Urgent remediation required (1 week)
- **Medium ({{Number}}):** Planned remediation (30 days)
- **Low ({{Number}}):** Scheduled remediation (90 days)
- **Informational ({{Number}}):** Address as resources permit

---

## Conclusion

{{Summary of the assessment findings. Highlight the most critical issues and provide an overall recommendation for the client.}}

---

**Prepared by:** {{Consultant Name}}  
**Title:** {{Consultant Title}}  
**Company:** {{Your Company Name}}  
**Date:** {{Date}}

---

## Appendix

### Code Snippets and Scripts

{{Include any additional scripts, payloads, or technical details used during the assessment.}}

Next steps

Operations — where the agent does the work that becomes a report.
Playbooks — drive report format and template from your own methodology.
File System — the outputs area where the agent writes deliverables.
Cybergraph — the evidence findings trace back to.

At a glance​

How reports are produced​

Download an output​

Manage outputs​

Custom templates​

Cybergraph traceability​

Default report template​

Next steps​