[GH-ISSUE #40] [Enhancement]: uninformative final report #19

New Issue

2026-06-06T22:08:02-04:00

yindo commented

2026-06-06 22:08:02 -04:00

Originally created by @vchaplygim on GitHub (May 12, 2025).
Original GitHub issue: https://github.com/vxcontrol/pentagi/issues/40

Originally assigned to: @asdek on GitHub.

Target Component

Documentation and User Experience

Enhancement Description

Description:

The Final Report in Pentagi is missing critical information necessary to understand and verify the findings:

There are no technical details or links included to clarify what exactly is being referred to in each finding.
While some links were present in earlier intermediate reports, they still lack explanations of how the issues were discovered and how the severity ratings were determined.

This makes it very difficult to reproduce, validate, or prioritize the findings properly.

Request:

Please revise the Final Report to include:

Relevant technical details, including PoC commands or steps where applicable.
Clear references or links to tools/scripts/resources used.
A brief explanation of the methodology or reasoning behind severity assessments.

Technical Details:

Screenshot attached for reference.

Technical Details

No response

Designs and Mockups

No response

Alternative Solutions

No response

Verification

I have checked that this enhancement hasn't been already proposed
This enhancement aligns with PentAGI's goal of autonomous penetration testing
I have considered the security implications of this enhancement
I have provided clear use cases and benefits

Originally created by @vchaplygim on GitHub (May 12, 2025). Original GitHub issue: https://github.com/vxcontrol/pentagi/issues/40 Originally assigned to: @asdek on GitHub. ### Target Component Documentation and User Experience ### Enhancement Description **Description:** The Final Report in Pentagi is missing critical information necessary to understand and verify the findings: - There are no technical details or links included to clarify what exactly is being referred to in each finding. - While some links were present in earlier intermediate reports, they still lack explanations of how the issues were discovered and how the severity ratings were determined. This makes it very difficult to reproduce, validate, or prioritize the findings properly. **Request:** Please revise the Final Report to include: - Relevant technical details, including PoC commands or steps where applicable. - Clear references or links to tools/scripts/resources used. - A brief explanation of the methodology or reasoning behind severity assessments. **Technical Details:** Screenshot attached for reference. <img width="589" alt="Image" src="https://github.com/user-attachments/assets/d50f9cb3-75fc-4626-9920-26f0ed758d49" /> ### Technical Details _No response_ ### Designs and Mockups _No response_ ### Alternative Solutions _No response_ ### Verification - [ ] I have checked that this enhancement hasn't been already proposed - [x] This enhancement aligns with PentAGI's goal of autonomous penetration testing - [x] I have considered the security implications of this enhancement - [ ] I have provided clear use cases and benefits

yindo added the enhancement label 2026-06-06 22:08:02 -04:00

yindo closed this issue

2026-06-06 22:08:02 -04:00

yindo commented

2026-06-06 22:08:02 -04:00

@asdek commented on GitHub (Jun 3, 2025):

Hello @vchaplygim

Thanks for the feedback on the reporting capabilities!

I've just released an update https://github.com/vxcontrol/pentagi/pull/44 that brings some good news - we now have basic reporting functionality built right into the UI:

This update also introduces assistant functionality, which is our first step toward more interactive pentesting. The assistants allow you to:

Ask about current status at any point
Query collected artifacts (from long-term memory)
Request command execution (termital, searches, files, etc.)
Maintain full control over the attack flow (delegate atomic tasks to built-in agents)

There are two main modes:

Assistant as a helper - explains and completes steps from the automation mode
Assistant as the primary interface - orchestrates other agents (there's a UI button that lets you include other agents for specific user requests)

If you already know the sequence of steps needed or just want to use PentAGI as a utility, you can start a new flow directly with an assistant without launching a full attack simulation. In this mode, there's no accumulated context, but it can use previously written instructions and work faster. The instructions are created whenever you enable agent functionality, even in assistant mode.

Another cool feature is that assistants can run on different LLM providers - you don't have to use the same one that was selected for automation mode. This is super helpful when certain models handle specific tasks better than others.

Also, each new assistant remembers conversations with previous ones, so you can create a new assistant to try different testing hypotheses and then go back to the first one, or create another assistant on a different LLM provider to see how it handles the same task.

Regarding artifact collection, I was inspired by this project: https://www.getzep.com/ and how it builds connections between different useful data. I'll keep your issue open for now - in the future, I plan to build something similar for organizing storage or integrate this service with PentAGI.

Please, let me know what you think about these updates!

@asdek commented on GitHub (Jun 3, 2025): Hello @vchaplygim Thanks for the feedback on the reporting capabilities! I've just released an update https://github.com/vxcontrol/pentagi/pull/44 that brings some good news - we now have basic reporting functionality built right into the UI: ![Image](https://github.com/user-attachments/assets/6653e043-bcb1-4bd2-bbfd-2574331d8ebd) This update also introduces assistant functionality, which is our first step toward more interactive pentesting. The assistants allow you to: - Ask about current status at any point - Query collected artifacts (from long-term memory) - Request command execution (termital, searches, files, etc.) - Maintain full control over the attack flow (delegate atomic tasks to built-in agents) There are two main modes: 1. Assistant as a helper - explains and completes steps from the automation mode 2. Assistant as the primary interface - orchestrates other agents (there's a UI button that lets you include other agents for specific user requests) If you already know the sequence of steps needed or just want to use PentAGI as a utility, you can start a new flow directly with an assistant without launching a full attack simulation. In this mode, there's no accumulated context, but it can use previously written instructions and work faster. The instructions are created whenever you enable agent functionality, even in assistant mode. Another cool feature is that assistants can run on different LLM providers - you don't have to use the same one that was selected for automation mode. This is super helpful when certain models handle specific tasks better than others. Also, each new assistant remembers conversations with previous ones, so you can create a new assistant to try different testing hypotheses and then go back to the first one, or create another assistant on a different LLM provider to see how it handles the same task. Regarding artifact collection, I was inspired by this project: https://www.getzep.com/ and how it builds connections between different useful data. I'll keep your issue open for now - in the future, I plan to build something similar for organizing storage or integrate this service with PentAGI. Please, let me know what you think about these updates!

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: vxcontrol/pentagi#19