Recon Skills: skill pack for Hermes Agent

Pack of security skills for authorized recon, web app testing, validation and reporting

What Recon Skills does

Recon Skills is a catalog of focused security skills. Each documents its objective along with prerequisites, procedure, pitfalls, verification criteria and related techniques. The folders cover authentication and SSO testing, multi-step attack chains, infrastructure, engagement planning, recon and enumeration, and vulnerability-class playbooks. The repository description names CORS, XSS, SQL injection, SSRF, RCE, WordPress, MCP, cloud and subdomain takeover among the topics.

You clone the repository and find skills by searching for SKILL.md files, with suggested entry points such as redteam/web2-recon and recon/subdomain-enumeration. Skills can be followed manually or loaded as task context by an automation system. A validator script, scripts/validate_skills.py, checks structure, and older skills are being migrated to the quality baseline in STYLE.md. The repository also ships a SOUL.md file with operating principles.

Key features

Skill folders for auth, chains, infra, meta, recon and redteam topics
Recon coverage of subdomain, DNS, port, HTTP and technology discovery
Authentication, session, OAuth, SAML and MFA testing skills
Evidence-hygiene and report-writing skills for client and bug bounty reports
Catalog validator script, scripts/validate_skills.py

When to use it

Running an authorized bug bounty assessment with a documented methodology
Planning an external web attack-surface review for a client engagement
Writing up validated findings with redacted, reproducible evidence

Who it is for: Security testers and bug bounty hunters who work on targets they own or have written permission to test.

How it fits with Hermes Agent

The repository carries the hermes-agent topic and is organized as SKILL.md skills, the format Hermes Agent skills use. The README does not describe a Hermes-specific install flow.

How to install Recon Skills

These commands are copied from the project's README. Check the repository for the latest steps before you run them.

git clone https://github.com/uphiago/recon-skills.git
cd recon-skills

Requirements: Standard Linux tooling unless a skill states otherwise; scope, credentials and isolation are the operator's responsibility

Note: The README states these skills are for authorized security testing only, on targets you own or have explicit written permission to test.

FAQ

What is Recon Skills?

Recon Skills is a curated pack of security skills for external reconnaissance, web applications, APIs, authentication, vulnerability validation, attack-path analysis and reporting. Each skill is a SKILL.md file with a focused objective.

Does Recon Skills work with Hermes Agent?

The repository is tagged hermes-agent and uses the SKILL.md layout, but the README does not give Hermes-specific setup steps. The skills can be followed manually or loaded as task context by an automation system.

Is Recon Skills free and open source?

Yes, the repository is released under the MIT license. The README states the skills are for authorized security testing only.