handnewb/hermes-cybersec-lab
🛡️ Turnkey cybersecurity lab for Hermes Agent — 397 CVE-driven skills, 152 tools, 28 frameworks (MITRE ATT&CK, MISP, CVSS, EPSS, OWASP, NIST, Sigma, YARA). Real exploits 2015–2026.
Hermes Cybersecurity Lab is a turnkey ecosystem designed for the Hermes Agent. It provides a collection of 2,077 skills, 131+ tools, and 28 cybersecurity frameworks across eight repositories.
- Includes 2,077 total skills across multiple repositories
- Installs 131+ tools for network, forensics, and exploitation
- Integrates 28 cybersecurity frameworks and standards
full readme from github
🛡️ Hermes Cybersecurity Lab
Turnkey cybersecurity ecosystem for Hermes Agent — 2,077 skills, 131+ tools, 28 frameworks across 8 repositories. Preconfigured toolkit with wordlists, forensics, and evolving methodology for security research, pentesting, forensics, threat hunting, and threat intelligence.
📊 Ecosystem at a Glance
| Layer | Count | Location |
|---|---|---|
| Skills | 2,077 | 397 embedded + 1,680 across 7 external repos |
| Tools | 150+ | Installed via scripts/install.sh — network, forensics, exploitation, cloud, CTI |
| Frameworks | 28 | MITRE ATT&CK/D3FEND/ATLAS/F3/FEND, NIST CSF/RMF, ISO 27001, OWASP (Web/LLM/AST10), CIS, CVSS, EPSS, Sigma, YARA, STIX, CWE, PTES, Cyber Kill Chain, Diamond Model, SSVC, IEC 62443 |
┌──────────────────────────────┐
│ hermes-cybersec-lab (core) │
│ 382 skills · 150+ tools │
│ 28 frameworks · install.sh │
└──────────┬───────────────────┘
│ clone-all.sh
┌─────────────────────┼─────────────────────┐
│ │ │
┌──────▼──────┐ ┌────────▼────────┐ ┌───────▼───────┐
│ Skill repos │ │ Playbook repos │ │ Reference │
│ 817 + 700+ │ │ 31 + 31 │ │ curated × 2 │
│ + 101+ │ │ │ │ │
└─────────────┘ └─────────────────┘ └───────────────┘
🚀 Quick Start
1. Clone everything (one command)
# Clone this repo
git clone https://github.com/handnewb/hermes-cybersec-lab.git
cd hermes-cybersec-lab
# Clone all 7 external repos (2,077 skills total)
bash scripts/clone-all.sh
This pulls every referenced repository into ./external/ — no piecemeal manual cloning.
2. Install all tools (one command)
bash scripts/install.sh
Installs 131+ tools across 7 phases: network recon, exploitation, malware analysis, forensics, web/cloud, CTI/OSINT, and wordlists.
3. Load in Hermes
cp -r . ~/.hermes/profiles/<profile>/skills/cybersecurity-lab/
🔧 What This Skill Provides
When loaded by Hermes, this skill gives the agent:
- Full ecosystem awareness — knows all 2,077 skills and which external repo holds each one
- Tool inventory awareness — knows which 131+ security tools are installed and where
- Structured methodology — passive recon → active scanning → exploitation → forensics → CTI → reporting
- Knowledge accumulation — findings, false positives, and lessons compound over time
- Daily updates — keep tools, wordlists, and nuclei templates current
📁 Repo Structure
hermes-cybersec-lab/
├── SKILL.md # Main skill — inventory, methodology, quick refs
├── README.md # This file
├── skills/ # 397 embedded SKILL.md files (AI-generated + curated)
├── references/
│ ├── skills-catalog.md # 397 embedded Hermes procedural skills (22 domains)
│ ├── tools-ecosystem.md # 131+ tools across 18 categories with install commands
│ ├── frameworks.md # 28 cybersecurity frameworks and standards
│ ├── methodology.md # Playbooks: recon, scanning, exploitation, forensics
│ └── findings.md # Living log — discoveries, IOCs, lessons learned
├── scripts/
│ ├── install.sh # One-shot installer for all 131+ tools + wordlists
│ └── clone-all.sh # One-shot cloner for all 8 ecosystem repos
└── external/ # Created by clone-all.sh — 7 external repos
🌐 External Repositories
| # | Repository | Skills | Focus |
|---|---|---|---|
| 1 | Anthropic-Cybersecurity-Skills | 817 | Largest cybersecurity skill collection; 29 domains |
| 2 | awesome-hermes-agent | 700+ | Curated Hermes security resources with mapped skills |
| 3 | awesome-hermes-skills | 101+ | Curated skill directory |
| 4 | violin | 31 | Supervised Hermes pentest profile with guard plugin |
| 5 | awesome-ai-security | 31 | AI security + Hermes pentest references |
| 6 | awesome-hermes-agent | curated | Skills, tools, integrations directory |
| 7 | awesome-hermes-agent-skills | curated | Best Hermes-compatible skills and skill factories |
📋 Skill Domains (embedded 382)
| Domain | Skills |
|---|---|
| 🔬 Malware Analysis & Reverse Engineering | 34 |
| 🔍 Forensics & DFIR | 22 |
| ⚔️ Exploitation & Post-Exploitation | 40 |
| 🧠 Threat Intelligence (CTI) | 32 |
| 🛡️ Vulnerability Management | 22 |
| ☁️ Cloud Security | 18 |
| 🌐 Web Application Security | 30 |
| 📡 API Security | 22 |
| 🏭 OT/ICS/SCADA Security | 25 |
| 🔎 OSINT & Reconnaissance | 20 |
| 🚨 Incident Response | 14 |
| 🎯 Threat Hunting & Detection | 14 |
| 🔧 Security Implementation & Hardening | 34 |
| 🔮 AI/LLM Security | 20 |
| 📱 Mobile Security | 20 |
| ☁️ Cloud Security Advanced | 8 |
🔧 Tool Categories (131+ tools)
| Category | Tools |
|---|---|
| 📡 Network | nmap, masscan, tcpdump, tshark, naabu, amass, subfinder, bettercap, dnsrecon, hydra, john |
| ⚔️ Exploitation | metasploit, searchsploit, sqlmap, impacket, crackmapexec, certipy, bloodhound, pacu, responder, evil-winrm |
| 🔬 Malware/RE | radare2, gdb, ghidra*, binwalk, foremost, upx, yara, pefile, oletools, pdf-parser, cuckoo*, vt-py |
| 🔍 Forensics | volatility3, velociraptor*, hayabusa*, plaso |
| 🌐 Web | zaproxy, nikto, ffuf, wafw00f, dirsearch, xsstrike, commix |
| ☁️ Cloud | scoutsuite, prowler, kube-hunter, checkov, trivy |
| 🛡️ Vuln Mgmt | nuclei, nessus* |
| 🧠 CTI | sigma-cli, spiderfoot, theharvester, recon-ng |
| 📚 Wordlists | SecLists, rockyou |
* requires manual installation
📊 Frameworks & Standards (28)
MITRE ATT&CK · MITRE D3FEND · MITRE ATLAS · MITRE F3 · MITRE FEND · MISP · STIX/TAXII · CVSS v4.0 · EPSS · CWE · Sigma · YARA · OWASP Top 10 · OWASP ASVS · OWASP LLM Top 10 · OWASP AST10 · OWASP Agentic 2026 · NIST CSF 2.0 · NIST SP 800-53 · NIST AI RMF · ISO 27001 · CIS Controls v8 · CISA KEV · PTES · Cyber Kill Chain · Diamond Model · SSVC · IEC 62443
🤝 Submit Findings
Found something interesting? Add it to references/findings.md after each engagement so the agent's knowledge compounds over time.
📜 License
MIT — use freely, contribute back.
This is a living lab. Tools, skills, and methodology improve with every engagement.