opsec-reporting

Opsec Reporting

End-to-end operational reporting for red team engagements — from evidence capture through secure delivery and post-engagement destruction. Every report produced through this skill is designed to protect both the operator and the client by enforcing metadata hygiene, redaction discipline, and secure handling throughout the report lifecycle.

Why This Matters

Reports are the most dangerous artifact an operator produces. They contain target details, exploitation paths, credentials, and internal architecture — all in a single document. A report leaked, intercepted, or left unencrypted on disk is an operational compromise. This skill treats reports as sensitive material from creation to destruction.

Report Lifecycle

Evidence Capture → Classification → Drafting → Redaction → Encryption → Delivery → Destruction

Every phase is documented. Every phase has opsec controls. Skip nothing.

Report Types

| Report Type | When to Use | Template | Reference | |-------------|-------------|----------|-----------| | Engagement Summary | End of any engagement | Executive + technical sections | references/report-templates.md | | Hardening Assessment | After system hardening audit | Coverage map + findings matrix | references/report-templates.md | | Trace Elimination | After cleanup operations | Artifact inventory + verification | references/report-templates.md | | VPS Security Audit | After VPS provisioning/audit | Provisioning checklist + exposure map | references/report-templates.md | | Purple Team Exercise | Joint red/blue engagement | Attack timeline + detection gaps | references/report-templates.md | | Compliance Assessment | PCI-DSS, SOC2, HIPAA mapping | Control mapping + gap analysis | references/compliance-reporting.md | | Debrief Package | Pre-presentation preparation | Slide-ready findings + demo notes | references/debrief-and-delivery.md | | Incident Timeline | Documenting operational chronology | Timestamped event sequence | references/report-templates.md |

Data Collection

Before writing any report, gather all available data from trenton's data layer:

# Operational data
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" coverage
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" list

# Identity rotation history
node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" list

# Current opsec profile
node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" show

# Session state and metrics
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

Evidence Handling

Read references/evidence-handling.md for full evidence handling procedures, including:

• Screenshot capture with automatic metadata stripping
• Chain of custody documentation
• Evidence hashing (SHA256) for integrity verification
• Secure evidence storage with encryption at rest
• Evidence correlation and cross-referencing

All evidence must be hashed on capture and logged to the ops tracker:

# Log evidence capture
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "evidence-capture" \
  --detail "Screenshot of <target>:<port> — SHA256:<hash>"

Redaction

Read references/redaction-methodology.md for redaction rules by opsec profile. Key principles:

• Always redact: Real credentials, API keys, tokens, session cookies
• Profile-dependent: IP addresses, hostnames, domain names, employee names
• Never redact: Finding descriptions, severity ratings, remediation steps

Redaction markers use consistent format: [REDACTED-<TYPE>-<SEQ>] (e.g., [REDACTED-IP-001], [REDACTED-CRED-003]). A redaction key mapping markers to real values is stored separately, encrypted, and delivered only to authorized recipients.

Severity Classification

Findings use dual classification — CVSS 3.1 base score for technical precision, DREAD for business context:

| Severity | CVSS Range | DREAD Range | Report Color | |----------|-----------|-------------|--------------| | Critical | 9.0 - 10.0 | 40 - 50 | Red | | High | 7.0 - 8.9 | 30 - 39 | Orange | | Medium | 4.0 - 6.9 | 20 - 29 | Yellow | | Low | 0.1 - 3.9 | 10 - 19 | Blue | | Informational | 0.0 | 0 - 9 | Gray |

See references/compliance-reporting.md for CVSS vector string construction and DREAD scoring methodology.

Opsec Profile Integration

Report handling adapts to the active opsec profile:

| Aspect | loud | normal | stealth | paranoid | |--------|--------|----------|-----------|------------| | Report format | Markdown on disk | Markdown on disk | Encrypted Markdown | Memory-only, encrypted export | | Evidence storage | Plain files | Plain files | GPG-encrypted archive | RAM disk, encrypted export | | Metadata stripping | None | Basic (exiftool) | Full (mat2 + exiftool) | Full + filename sanitization | | Delivery method | Email/upload | Encrypted email | Encrypted dead drop | Air-gapped transfer | | Retention | Indefinite | 90 days | 30 days | Destroy after delivery confirmation | | Redaction level | Minimal | Standard | Aggressive | Maximum (all identifiers) |

Check the current profile before generating any report:

node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" get

Report Output

Reports are written to the project directory under reports/:

reports/
├── engagement-summary-<target>-<YYYYMMDD>.md
├── hardening-<target>-<YYYYMMDD>.md
├── trace-elimination-<target>-<YYYYMMDD>.md
├── vps-audit-<target>-<YYYYMMDD>.md
├── purple-team-<target>-<YYYYMMDD>.md
├── compliance-<framework>-<target>-<YYYYMMDD>.md
├── debrief-<target>-<YYYYMMDD>.md
├── evidence/
│   ├── screenshots/           # Metadata-stripped screenshots
│   ├── captures/              # Network captures, command outputs
│   └── hashes.jsonl           # SHA256 hashes of all evidence files
├── redaction-key-<YYYYMMDD>.gpg  # Encrypted redaction mapping
└── delivery-receipt-<YYYYMMDD>.md # Delivery confirmation log

Report Encryption

For stealth and paranoid profiles, encrypt reports before writing to disk:

# GPG symmetric encryption (recipient doesn't need your key)
gpg --symmetric --cipher-algo AES256 --armor \
  -o reports/engagement-summary-target-20260320.md.gpg \
  reports/engagement-summary-target-20260320.md

# Then securely delete the plaintext
shred -vfz -n 3 reports/engagement-summary-target-20260320.md

Secure Delivery

Read references/debrief-and-delivery.md for delivery procedures per profile. Quick reference:

| Method | Profile | How | |--------|---------|-----| | Direct email | loud / normal | Attach report, CC stakeholders | | Encrypted email | normal / stealth | GPG-encrypted attachment, key exchanged out-of-band | | Secure file share | stealth | Time-limited link (OnionShare, Magic Wormhole, Tresorit) | | Dead drop | paranoid | Pre-arranged location, one-time retrieval, auto-expiry | | Air-gapped transfer | paranoid | USB via secure facility, no network involved |

Post-Engagement Destruction

After delivery confirmation, destroy local copies according to profile:

# Secure deletion of report files
shred -vfz -n 3 reports/*.md reports/*.gpg
shred -vfz -n 3 reports/evidence/screenshots/*
shred -vfz -n 3 reports/evidence/captures/*
shred -vfz -n 3 reports/redaction-key-*.gpg

# Wipe free space on the partition (paranoid only)
sfill -v /path/to/reports/

# Log the destruction
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "artifact-destruction" \
  --detail "All reports and evidence securely destroyed post-delivery"

Logging

All reporting operations MUST be logged:

node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "<action>" \
  --detail "<detail>"

Actions: evidence-capture, report-draft, redaction-pass, `encrypti