vm-security-report-generator

# Security Report Generator Skill

Transforms consolidated security findings into a formatted HTML report with VIRIM branding.

## Brownfield Context

This skill generates reports from security analyses of **existing codebases**. It structures findings to clearly distinguish between pre-existing issues (present in the original codebase) and newly introduced issues (present only in the changed files), when scoping information is provided. This distinction is critical for brownfield assessments — teams need to know what existed before vs what a change introduced.

## When to Use This Skill

- Generating the final HTML report at the end of a Security Analysis Agent run
- Producing a formatted output for stakeholders from aggregated security findings
- Creating a structured `docs/security-analysis/` report artifact

## Unitary Function

**ONE RESPONSIBILITY:** Format aggregated security findings into a standardized HTML report

**NOT RESPONSIBLE FOR:**
- Running security checks (see vulnerability scanner, auth auditor, etc.)
- Aggregating findings (that is the Security Analysis Agent's responsibility)
- Fixing vulnerabilities (reporting only, read-only regarding source)

## Input

Consolidated findings JSON from the Security Analysis Agent:

```json
{
  "summary": {
    "project_name": "string",
    "repository_path": "string",
    "scan_date": "ISO-8601",
    "scope": "full|change_scoped",
    "changed_files_count": 0,
    "languages": [],
    "total_issues": 0,
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0,
    "checks_executed": 0
  },
  "findings": [
    {
      "id": "VULN-001",
      "severity": "critical",
      "category": "SQL Injection",
      "source_skill": "vm-input-validation-checker",
      "location": "app/routes.py:45",
      "description": "Unsanitized user input in SQL query",
      "remediation": "Use parameterized queries or ORM",
      "cwe": "CWE-89",
      "owasp": "A03:2021",
      "introduced_by_change": true
    }
  ],
  "checks_executed": [],
  "remediation_plan": {
    "immediate": [],
    "next_sprint": [],
    "backlog": []
  }
}
```

## Output

Writes to `docs/security-analysis/`:
- `findings.json` — machine-readable findings for downstream agents (Change Management)
- `security-report.html` — branded HTML dashboard

## HTML Report Structure

The HTML report uses VIRIM brand colors (`#00664F` green, `#FED141` gold, `#101820` dark) and Open Sans font stack. It includes:

1. **Executive Summary** — severity counts, overall risk score, scan scope (full or change-scoped)
2. **Change-Introduced Issues** — issues traceable to the current change set (highlighted separately)
3. **Pre-Existing Issues** — issues present in the original codebase baseline
4. **Findings by Category** — OWASP category breakdown with file/line references
5. **Remediation Plan** — immediate / next-sprint / backlog tiers
6. **Skills Executed** — which security skills ran and their individual finding counts

## Generated-by Watermark