Opsec Reporting

End-to-end operational reporting for red team engagements — from evidence capture through secure delivery and post-engagement destruction. Every report produced through this skill is designed to protect both the operator and the client by enforcing metadata hygiene, redaction discipline, and secure handling throughout the report lifecycle.

Why This Matters

Reports are the most dangerous artifact an operator produces. They contain target details, exploitation paths, credentials, and internal architecture — all in a single document. A report leaked, intercepted, or left unencrypted on disk is an operational compromise. This skill treats reports as sensitive material from creation to destruction.

Report Lifecycle

Evidence Capture → Classification → Drafting → Redaction → Encryption → Delivery → Destruction

Every phase is documented. Every phase has opsec controls. Skip nothing.

Report Types

Data Collection

Before writing any report, gather all available data from trenton's data layer:

# Operational data
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" coverage
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" list

# Identity rotation history
node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" summary
node "${CLAUDE_PLUGIN_ROOT}/scripts/identity-tracker.js" list

# Current opsec profile
node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" show

# Session state and metrics
node "${CLAUDE_PLUGIN_ROOT}/scripts/session-state.js" show

Evidence Handling

Read references/evidence-handling.md for full evidence handling procedures, including:

• Screenshot capture with automatic metadata stripping
• Chain of custody documentation
• Evidence hashing (SHA256) for integrity verification
• Secure evidence storage with encryption at rest
• Evidence correlation and cross-referencing

All evidence must be hashed on capture and logged to the ops tracker:

# Log evidence capture
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "evidence-capture" \
  --detail "Screenshot of <target>:<port> — SHA256:<hash>"

Redaction

Read references/redaction-methodology.md for redaction rules by opsec profile. Key principles:

• Always redact: Real credentials, API keys, tokens, session cookies
• Profile-dependent: IP addresses, hostnames, domain names, employee names
• Never redact: Finding descriptions, severity ratings, remediation steps

Redaction markers use consistent format: [REDACTED-<TYPE>-<SEQ>] (e.g., [REDACTED-IP-001], [REDACTED-CRED-003]). A redaction key mapping markers to real values is stored separately, encrypted, and delivered only to authorized recipients.

Severity Classification

Findings use dual classification — CVSS 3.1 base score for technical precision, DREAD for business context:

See references/compliance-reporting.md for CVSS vector string construction and DREAD scoring methodology.

Opsec Profile Integration

Report handling adapts to the active opsec profile:

Check the current profile before generating any report:

node "${CLAUDE_PLUGIN_ROOT}/scripts/opsec-profile.js" get

Report Output

Reports are written to the project directory under reports/:

reports/
├── engagement-summary-<target>-<YYYYMMDD>.md
├── hardening-<target>-<YYYYMMDD>.md
├── trace-elimination-<target>-<YYYYMMDD>.md
├── vps-audit-<target>-<YYYYMMDD>.md
├── purple-team-<target>-<YYYYMMDD>.md
├── compliance-<framework>-<target>-<YYYYMMDD>.md
├── debrief-<target>-<YYYYMMDD>.md
├── evidence/
│   ├── screenshots/           # Metadata-stripped screenshots
│   ├── captures/              # Network captures, command outputs
│   └── hashes.jsonl           # SHA256 hashes of all evidence files
├── redaction-key-<YYYYMMDD>.gpg  # Encrypted redaction mapping
└── delivery-receipt-<YYYYMMDD>.md # Delivery confirmation log

Report Encryption

For stealth and paranoid profiles, encrypt reports before writing to disk:

# GPG symmetric encryption (recipient doesn't need your key)
gpg --symmetric --cipher-algo AES256 --armor \
  -o reports/engagement-summary-target-20260320.md.gpg \
  reports/engagement-summary-target-20260320.md

# Then securely delete the plaintext
shred -vfz -n 3 reports/engagement-summary-target-20260320.md

Secure Delivery

Read references/debrief-and-delivery.md for delivery procedures per profile. Quick reference:

Post-Engagement Destruction

After delivery confirmation, destroy local copies according to profile:

# Secure deletion of report files
shred -vfz -n 3 reports/*.md reports/*.gpg
shred -vfz -n 3 reports/evidence/screenshots/*
shred -vfz -n 3 reports/evidence/captures/*
shred -vfz -n 3 reports/redaction-key-*.gpg

# Wipe free space on the partition (paranoid only)
sfill -v /path/to/reports/

# Log the destruction
node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "artifact-destruction" \
  --detail "All reports and evidence securely destroyed post-delivery"

Logging

All reporting operations MUST be logged:

node "${CLAUDE_PLUGIN_ROOT}/scripts/ops-tracker.js" add \
  --category "reporting" --action "<action>" \
  --detail "<detail>"

Actions: evidence-capture, report-draft, redaction-pass, `encrypti