Stop asking Claude to rewrite the audit: vault-posture adds an offline report

A community Claude Code skill is taking a recurring audit task away from free-form generation. The October 21 update to vault-posture adds an offline report command that renders collected HashiCorp Vault findings into Markdown for operators, security reviewers and change tickets.

The original issue identifies the problem plainly: Claude had been writing these reports by hand, allowing layout and remediation commands to drift between requests. PR 41 merged at 10:51 UTC, and the merged skill now tells Claude to run the renderer when asked for a write-up.

Existing findings in, a repeatable report out

The command accepts one or more posture, roles, PKI, quotas or security result files from the same cluster:

uv run --script vault_posture.py report result.json --output-dir reports

An optional --diff adds changes since an earlier run. The implementation merges findings by fingerprint, combines coverage and refuses mixed-cluster inputs. The report groups and ranks findings, lists uncovered scopes and draws remediation text from the maintained rule catalogue. Missing inputs for a remediation placeholder remain for a human to supply; the renderer does not invent them.

Reporting needs no Vault connection or token. That distinction applies to this offline command: collecting fresh findings still requires network access, a short-lived read-only Vault token and appropriate policies. The skill expressly leaves every proposed fix for an operator to execute. Its optional PKI reader policy has broader path matching, a permission tradeoff the README documents rather than hides.

Where it fits

This is a plugin-distributed skill for Claude Code, not a new Vault service or a replacement model. Installation uses /plugin marketplace add nhsy/claude-demo, then /plugin install vault-posture@vault-posture-skill. The bundled script requires uv, which installs its pinned Python dependencies on first use; the repository is MPL 2.0. Claude Code access and any associated service costs remain separate.

The author reports adding 40 report tests and passing local lint, tests and plugin validation. AITrending reviewed the merged source and documentation but did not run a Vault environment. The concrete improvement is a consistent, inspectable reporting path, not proof that every finding or drafted fix is correct for every deployment. The command writes Markdown, not PDF.