docs: 30-day overhaul — correctness audit, PR coverage, Nous Portal weave, sidebar reorg (#33782)
* docs(audit): correctness pass across getting-started, reference, features, messaging, developer-guide, guides, integrations, user-guide * docs: add PR coverage for last 30d + Nous Portal weave + nav reorg + build fixes - Add docs for top user-visible PRs that shipped without docs (api-server session control, kanban features, telegram pin/edit, provider client tag, xAI retired-model migration, cron name lookup, --branch update flag, etc.) - Apply Nous Portal weave across 23 pages (tasteful one-liners on getting-started/learning-path, configuration, overview, vision, x-search, credential-pools, provider-routing, cron, codex-runtime, profiles, docker, messaging/index, multiple guides, plus FAQ + index promotion) - Reorganize sidebar: split Messaging into Popular/M365/Chinese/Other, Reference into Command/Configuration/Tools-Skills sub-categories, add orphan developer-guide pages (web-search-provider-plugin, browser-supervisor), move features from Integrations back to Features, fold lone spotify into Media & Web. - Regenerate skill stubs + catalogs (kanban-codex-lane, hermes-s6-container- supervision, web-pentest) - Fix broken anchor links (security/cron, configuration/fallback, telegram large-files, adding-platform-adapters step-by-step)
This commit is contained in:
Teknium
+1
-1
@@ -21,7 +21,7 @@ Delegate coding tasks to Blackbox AI CLI agent. Multi-model agent with built-in
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Coding-Agent`, `Blackbox`, `Multi-Agent`, `Judge`, `Multi-Model` |
|
||||
| Related skills | [`claude-code`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-claude-code), [`codex`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-codex), [`hermes-agent`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
| Related skills | [`claude-code`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-claude-code), [`codex`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-codex), [`hermes-agent`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ Configure and use Honcho memory with Hermes -- cross-session user modeling, mult
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Honcho`, `Memory`, `Profiles`, `Observation`, `Dialectic`, `User-Modeling`, `Session-Summary` |
|
||||
| Related skills | [`hermes-agent`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
| Related skills | [`hermes-agent`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ Delegate coding to OpenHands CLI (model-agnostic, LiteLLM).
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos |
|
||||
| Tags | `Coding-Agent`, `OpenHands`, `Model-Agnostic`, `LiteLLM` |
|
||||
| Related skills | [`claude-code`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-claude-code), [`codex`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-codex), [`opencode`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-opencode), [`hermes-agent`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
| Related skills | [`claude-code`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-claude-code), [`codex`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-codex), [`opencode`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-opencode), [`hermes-agent`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Read-only EVM client: wallets, tokens, gas across 8 chains.
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `EVM`, `Ethereum`, `BNB`, `BSC`, `Base`, `Arbitrum`, `Polygon`, `Optimism`, `Avalanche`, `zkSync`, `Blockchain`, `Crypto`, `Web3`, `DeFi`, `NFT`, `ENS`, `Whale`, `Security` |
|
||||
| Related skills | [`solana`](/user-guide/skills/optional/blockchain/blockchain-solana) |
|
||||
| Related skills | [`solana`](/docs/user-guide/skills/optional/blockchain/blockchain-solana) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Generate flat, minimal light/dark-aware SVG diagrams as standalone HTML files, u
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `diagrams`, `svg`, `visualization`, `education`, `physics`, `chemistry`, `engineering` |
|
||||
| Related skills | [`architecture-diagram`](/user-guide/skills/bundled/creative/creative-architecture-diagram), [`excalidraw`](/user-guide/skills/bundled/creative/creative-excalidraw), `generative-widgets` |
|
||||
| Related skills | [`architecture-diagram`](/docs/user-guide/skills/bundled/creative/creative-architecture-diagram), [`excalidraw`](/docs/user-guide/skills/bundled/creative/creative-excalidraw), `generative-widgets` |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Create HTML-based video compositions, animated title cards, social overlays, cap
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `creative`, `video`, `animation`, `html`, `gsap`, `motion-graphics` |
|
||||
| Related skills | [`manim-video`](/user-guide/skills/bundled/creative/creative-manim-video), [`meme-generation`](/user-guide/skills/optional/creative/creative-meme-generation) |
|
||||
| Related skills | [`manim-video`](/docs/user-guide/skills/bundled/creative/creative-manim-video), [`meme-generation`](/docs/user-guide/skills/optional/creative/creative-meme-generation) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
+1
-1
@@ -21,7 +21,7 @@ Plan, set up, and monitor a multi-agent video production pipeline backed by Herm
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `video`, `kanban`, `multi-agent`, `orchestration`, `production-pipeline` |
|
||||
| Related skills | [`kanban-orchestrator`](/user-guide/skills/bundled/devops/devops-kanban-orchestrator), [`kanban-worker`](/user-guide/skills/bundled/devops/devops-kanban-worker), [`ascii-video`](/user-guide/skills/bundled/creative/creative-ascii-video), [`manim-video`](/user-guide/skills/bundled/creative/creative-manim-video), [`p5js`](/user-guide/skills/bundled/creative/creative-p5js), [`comfyui`](/user-guide/skills/bundled/creative/creative-comfyui), [`touchdesigner-mcp`](/user-guide/skills/bundled/creative/creative-touchdesigner-mcp), [`blender-mcp`](/user-guide/skills/optional/creative/creative-blender-mcp), [`pixel-art`](/user-guide/skills/bundled/creative/creative-pixel-art), [`ascii-art`](/user-guide/skills/bundled/creative/creative-ascii-art), [`songwriting-and-ai-music`](/user-guide/skills/bundled/creative/creative-songwriting-and-ai-music), [`heartmula`](/user-guide/skills/bundled/media/media-heartmula), [`songsee`](/user-guide/skills/bundled/media/media-songsee), [`spotify`](/user-guide/skills/bundled/media/media-spotify), [`youtube-content`](/user-guide/skills/bundled/media/media-youtube-content), [`claude-design`](/user-guide/skills/bundled/creative/creative-claude-design), [`excalidraw`](/user-guide/skills/bundled/creative/creative-excalidraw), [`architecture-diagram`](/user-guide/skills/bundled/creative/creative-architecture-diagram), [`concept-diagrams`](/user-guide/skills/optional/creative/creative-concept-diagrams), [`baoyu-comic`](/user-guide/skills/bundled/creative/creative-baoyu-comic), [`baoyu-infographic`](/user-guide/skills/bundled/creative/creative-baoyu-infographic), [`humanizer`](/user-guide/skills/bundled/creative/creative-humanizer), [`gif-search`](/user-guide/skills/bundled/media/media-gif-search), [`meme-generation`](/user-guide/skills/optional/creative/creative-meme-generation) |
|
||||
| Related skills | [`kanban-orchestrator`](/docs/user-guide/skills/bundled/devops/devops-kanban-orchestrator), [`kanban-worker`](/docs/user-guide/skills/bundled/devops/devops-kanban-worker), [`ascii-video`](/docs/user-guide/skills/bundled/creative/creative-ascii-video), [`manim-video`](/docs/user-guide/skills/bundled/creative/creative-manim-video), [`p5js`](/docs/user-guide/skills/bundled/creative/creative-p5js), [`comfyui`](/docs/user-guide/skills/bundled/creative/creative-comfyui), [`touchdesigner-mcp`](/docs/user-guide/skills/bundled/creative/creative-touchdesigner-mcp), [`blender-mcp`](/docs/user-guide/skills/optional/creative/creative-blender-mcp), [`pixel-art`](/docs/user-guide/skills/bundled/creative/creative-pixel-art), [`ascii-art`](/docs/user-guide/skills/bundled/creative/creative-ascii-art), [`songwriting-and-ai-music`](/docs/user-guide/skills/bundled/creative/creative-songwriting-and-ai-music), [`heartmula`](/docs/user-guide/skills/bundled/media/media-heartmula), [`songsee`](/docs/user-guide/skills/bundled/media/media-songsee), [`spotify`](/docs/user-guide/skills/bundled/media/media-spotify), [`youtube-content`](/docs/user-guide/skills/bundled/media/media-youtube-content), [`claude-design`](/docs/user-guide/skills/bundled/creative/creative-claude-design), [`excalidraw`](/docs/user-guide/skills/bundled/creative/creative-excalidraw), [`architecture-diagram`](/docs/user-guide/skills/bundled/creative/creative-architecture-diagram), [`concept-diagrams`](/docs/user-guide/skills/optional/creative/creative-concept-diagrams), [`baoyu-comic`](/docs/user-guide/skills/bundled/creative/creative-baoyu-comic), [`baoyu-infographic`](/docs/user-guide/skills/bundled/creative/creative-baoyu-infographic), [`humanizer`](/docs/user-guide/skills/bundled/creative/creative-humanizer), [`gif-search`](/docs/user-guide/skills/bundled/media/media-gif-search), [`meme-generation`](/docs/user-guide/skills/optional/creative/creative-meme-generation) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Generate real meme images by picking a template and overlaying text with Pillow.
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `creative`, `memes`, `humor`, `images` |
|
||||
| Related skills | [`ascii-art`](/user-guide/skills/bundled/creative/creative-ascii-art), `generative-widgets` |
|
||||
| Related skills | [`ascii-art`](/docs/user-guide/skills/bundled/creative/creative-ascii-art), `generative-widgets` |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Zero-install localhost tunnels over SSH via Pinggy.
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Pinggy`, `Tunnel`, `Networking`, `SSH`, `Webhook`, `Localhost` |
|
||||
| Related skills | `cloudflared-quick-tunnel`, [`webhook-subscriptions`](/user-guide/skills/bundled/devops/devops-webhook-subscriptions) |
|
||||
| Related skills | `cloudflared-quick-tunnel`, [`webhook-subscriptions`](/docs/user-guide/skills/bundled/devops/devops-webhook-subscriptions) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Roleplay the most difficult, tech-resistant user for your product. Browse the ap
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `qa`, `ux`, `testing`, `adversarial`, `dogfood`, `personas`, `user-testing` |
|
||||
| Related skills | [`dogfood`](/user-guide/skills/bundled/dogfood/dogfood-dogfood) |
|
||||
| Related skills | [`dogfood`](/docs/user-guide/skills/bundled/dogfood/dogfood-dogfood) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build fully-integrated 3-statement models (IS, BS, CF) in Excel with working cap
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `finance`, `three-statement`, `income-statement`, `balance-sheet`, `cash-flow`, `excel`, `openpyxl`, `modeling` |
|
||||
| Related skills | [`excel-author`](/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/user-guide/skills/optional/finance/finance-dcf-model), [`lbo-model`](/user-guide/skills/optional/finance/finance-lbo-model) |
|
||||
| Related skills | [`excel-author`](/docs/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/docs/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/docs/user-guide/skills/optional/finance/finance-dcf-model), [`lbo-model`](/docs/user-guide/skills/optional/finance/finance-lbo-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build comparable company analysis in Excel — operating metrics, valuation mult
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `finance`, `valuation`, `comps`, `excel`, `openpyxl`, `modeling`, `investment-banking` |
|
||||
| Related skills | [`excel-author`](/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/user-guide/skills/optional/finance/finance-dcf-model), [`lbo-model`](/user-guide/skills/optional/finance/finance-lbo-model) |
|
||||
| Related skills | [`excel-author`](/docs/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/docs/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/docs/user-guide/skills/optional/finance/finance-dcf-model), [`lbo-model`](/docs/user-guide/skills/optional/finance/finance-lbo-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build institutional-quality DCF valuation models in Excel — revenue projection
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `finance`, `valuation`, `dcf`, `excel`, `openpyxl`, `modeling`, `investment-banking` |
|
||||
| Related skills | [`excel-author`](/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/user-guide/skills/optional/finance/finance-pptx-author), [`comps-analysis`](/user-guide/skills/optional/finance/finance-comps-analysis), [`lbo-model`](/user-guide/skills/optional/finance/finance-lbo-model), [`3-statement-model`](/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
| Related skills | [`excel-author`](/docs/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/docs/user-guide/skills/optional/finance/finance-pptx-author), [`comps-analysis`](/docs/user-guide/skills/optional/finance/finance-comps-analysis), [`lbo-model`](/docs/user-guide/skills/optional/finance/finance-lbo-model), [`3-statement-model`](/docs/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build auditable Excel workbooks headless with openpyxl — blue/black/green cell
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `excel`, `openpyxl`, `finance`, `spreadsheet`, `modeling` |
|
||||
| Related skills | [`pptx-author`](/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/user-guide/skills/optional/finance/finance-dcf-model), [`comps-analysis`](/user-guide/skills/optional/finance/finance-comps-analysis), [`lbo-model`](/user-guide/skills/optional/finance/finance-lbo-model), [`3-statement-model`](/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
| Related skills | [`pptx-author`](/docs/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/docs/user-guide/skills/optional/finance/finance-dcf-model), [`comps-analysis`](/docs/user-guide/skills/optional/finance/finance-comps-analysis), [`lbo-model`](/docs/user-guide/skills/optional/finance/finance-lbo-model), [`3-statement-model`](/docs/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build leveraged buyout models in Excel — sources & uses, debt schedule, cash s
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `finance`, `valuation`, `lbo`, `private-equity`, `excel`, `openpyxl`, `modeling` |
|
||||
| Related skills | [`excel-author`](/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/user-guide/skills/optional/finance/finance-dcf-model), [`3-statement-model`](/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
| Related skills | [`excel-author`](/docs/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/docs/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/docs/user-guide/skills/optional/finance/finance-dcf-model), [`3-statement-model`](/docs/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build accretion/dilution (merger) models in Excel — pro-forma P&L, synergies,
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `finance`, `m-and-a`, `merger`, `accretion-dilution`, `excel`, `openpyxl`, `modeling`, `investment-banking` |
|
||||
| Related skills | [`excel-author`](/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/user-guide/skills/optional/finance/finance-dcf-model), [`3-statement-model`](/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
| Related skills | [`excel-author`](/docs/user-guide/skills/optional/finance/finance-excel-author), [`pptx-author`](/docs/user-guide/skills/optional/finance/finance-pptx-author), [`dcf-model`](/docs/user-guide/skills/optional/finance/finance-dcf-model), [`3-statement-model`](/docs/user-guide/skills/optional/finance/finance-3-statement-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build PowerPoint decks headless with python-pptx. Pairs with excel-author for mo
|
||||
| License | Apache-2.0 |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `powerpoint`, `pptx`, `python-pptx`, `presentation`, `finance` |
|
||||
| Related skills | [`excel-author`](/user-guide/skills/optional/finance/finance-excel-author), [`powerpoint`](/user-guide/skills/bundled/productivity/productivity-powerpoint) |
|
||||
| Related skills | [`excel-author`](/docs/user-guide/skills/optional/finance/finance-excel-author), [`powerpoint`](/docs/user-guide/skills/bundled/productivity/productivity-powerpoint) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Stock quotes, history, search, compare, crypto via Yahoo.
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Stocks`, `Finance`, `Market`, `Crypto`, `Investing` |
|
||||
| Related skills | [`dcf-model`](/user-guide/skills/optional/finance/finance-dcf-model), [`comps-analysis`](/user-guide/skills/optional/finance/finance-comps-analysis), [`lbo-model`](/user-guide/skills/optional/finance/finance-lbo-model) |
|
||||
| Related skills | [`dcf-model`](/docs/user-guide/skills/optional/finance/finance-dcf-model), [`comps-analysis`](/docs/user-guide/skills/optional/finance/finance-comps-analysis), [`lbo-model`](/docs/user-guide/skills/optional/finance/finance-lbo-model) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Build, test, inspect, install, and deploy MCP servers with FastMCP in Python. Us
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `MCP`, `FastMCP`, `Python`, `Tools`, `Resources`, `Prompts`, `Deployment` |
|
||||
| Related skills | [`native-mcp`](/user-guide/skills/bundled/mcp/mcp-native-mcp), [`mcporter`](/user-guide/skills/optional/mcp/mcp-mcporter) |
|
||||
| Related skills | [`native-mcp`](/docs/user-guide/skills/bundled/mcp/mcp-native-mcp), [`mcporter`](/docs/user-guide/skills/optional/mcp/mcp-mcporter) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Migrate a user's OpenClaw customization footprint into Hermes Agent. Imports Her
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Migration`, `OpenClaw`, `Hermes`, `Memory`, `Persona`, `Import` |
|
||||
| Related skills | [`hermes-agent`](/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
| Related skills | [`hermes-agent`](/docs/user-guide/skills/bundled/autonomous-ai-agents/autonomous-ai-agents-hermes-agent) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Shop.app: product search, order tracking, returns, reorder.
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Shopping`, `E-commerce`, `Shop.app`, `Products`, `Orders`, `Returns` |
|
||||
| Related skills | [`shopify`](/user-guide/skills/optional/productivity/productivity-shopify), [`maps`](/user-guide/skills/bundled/productivity/productivity-maps) |
|
||||
| Related skills | [`shopify`](/docs/user-guide/skills/optional/productivity/productivity-shopify), [`maps`](/docs/user-guide/skills/bundled/productivity/productivity-maps) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Shopify Admin & Storefront GraphQL APIs via curl. Products, orders, customers, i
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Shopify`, `E-commerce`, `Commerce`, `API`, `GraphQL` |
|
||||
| Related skills | [`airtable`](/user-guide/skills/bundled/productivity/productivity-airtable), [`xurl`](/user-guide/skills/bundled/social-media/social-media-xurl) |
|
||||
| Related skills | [`airtable`](/docs/user-guide/skills/bundled/productivity/productivity-airtable), [`xurl`](/docs/user-guide/skills/bundled/social-media/social-media-xurl) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ SiYuan Note API for searching, reading, creating, and managing blocks and docume
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `SiYuan`, `Notes`, `Knowledge Base`, `PKM`, `API` |
|
||||
| Related skills | [`obsidian`](/user-guide/skills/bundled/note-taking/note-taking-obsidian), [`notion`](/user-guide/skills/bundled/productivity/productivity-notion) |
|
||||
| Related skills | [`obsidian`](/docs/user-guide/skills/bundled/note-taking/note-taking-obsidian), [`notion`](/docs/user-guide/skills/bundled/productivity/productivity-notion) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Give Hermes phone capabilities without core tool changes. Provision and persist
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `telephony`, `phone`, `sms`, `mms`, `voice`, `twilio`, `bland.ai`, `vapi`, `calling`, `texting` |
|
||||
| Related skills | [`maps`](/user-guide/skills/bundled/productivity/productivity-maps), [`google-workspace`](/user-guide/skills/bundled/productivity/productivity-google-workspace), [`agentmail`](/user-guide/skills/optional/email/email-agentmail) |
|
||||
| Related skills | [`maps`](/docs/user-guide/skills/bundled/productivity/productivity-maps), [`google-workspace`](/docs/user-guide/skills/bundled/productivity/productivity-google-workspace), [`agentmail`](/docs/user-guide/skills/optional/email/email-agentmail) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Evolve prompts/regex/SQL/code with Imbue's evolution loop.
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos |
|
||||
| Tags | `evolution`, `optimization`, `prompt-engineering`, `research` |
|
||||
| Related skills | [`arxiv`](/user-guide/skills/bundled/research/research-arxiv), [`jupyter-live-kernel`](/user-guide/skills/bundled/data-science/data-science-jupyter-live-kernel) |
|
||||
| Related skills | [`arxiv`](/docs/user-guide/skills/bundled/research/research-arxiv), [`jupyter-live-kernel`](/docs/user-guide/skills/bundled/data-science/data-science-jupyter-live-kernel) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Free web search via DuckDuckGo — text, news, images, videos. No API key needed
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `search`, `duckduckgo`, `web-search`, `free`, `fallback` |
|
||||
| Related skills | [`arxiv`](/user-guide/skills/bundled/research/research-arxiv) |
|
||||
| Related skills | [`arxiv`](/docs/user-guide/skills/bundled/research/research-arxiv) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Index a codebase with GitNexus and serve an interactive knowledge graph via web
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `gitnexus`, `code-intelligence`, `knowledge-graph`, `visualization` |
|
||||
| Related skills | [`native-mcp`](/user-guide/skills/bundled/mcp/mcp-native-mcp), [`codebase-inspection`](/user-guide/skills/bundled/github/github-codebase-inspection) |
|
||||
| Related skills | [`native-mcp`](/docs/user-guide/skills/bundled/mcp/mcp-native-mcp), [`codebase-inspection`](/docs/user-guide/skills/bundled/github/github-codebase-inspection) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@ Public-records OSINT investigation framework — SEC EDGAR filings, USAspending
|
||||
| Author | Hermes Agent (adapted from ShinMegamiBoson/OpenPlanter, MIT) |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `osint`, `investigation`, `public-records`, `sec`, `sanctions`, `corporate-registry`, `property`, `courts`, `due-diligence`, `journalism` |
|
||||
| Related skills | [`domain-intel`](/user-guide/skills/optional/research/research-domain-intel), [`arxiv`](/user-guide/skills/bundled/research/research-arxiv) |
|
||||
| Related skills | [`domain-intel`](/docs/user-guide/skills/optional/research/research-domain-intel), [`arxiv`](/docs/user-guide/skills/bundled/research/research-arxiv) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Optional vendor skill for Parallel CLI — agent-native web search, extraction,
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Research`, `Web`, `Search`, `Deep-Research`, `Enrichment`, `CLI` |
|
||||
| Related skills | [`duckduckgo-search`](/user-guide/skills/optional/research/research-duckduckgo-search), [`mcporter`](/user-guide/skills/optional/mcp/mcp-mcporter) |
|
||||
| Related skills | [`duckduckgo-search`](/docs/user-guide/skills/optional/research/research-duckduckgo-search), [`mcporter`](/docs/user-guide/skills/optional/mcp/mcp-mcporter) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Search personal knowledge bases, notes, docs, and meeting transcripts locally us
|
||||
| License | MIT |
|
||||
| Platforms | macos, linux |
|
||||
| Tags | `Search`, `Knowledge-Base`, `RAG`, `Notes`, `MCP`, `Local-AI` |
|
||||
| Related skills | [`obsidian`](/user-guide/skills/bundled/note-taking/note-taking-obsidian), [`native-mcp`](/user-guide/skills/bundled/mcp/mcp-native-mcp), [`arxiv`](/user-guide/skills/bundled/research/research-arxiv) |
|
||||
| Related skills | [`obsidian`](/docs/user-guide/skills/bundled/note-taking/note-taking-obsidian), [`native-mcp`](/docs/user-guide/skills/bundled/mcp/mcp-native-mcp), [`arxiv`](/docs/user-guide/skills/bundled/research/research-arxiv) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Web scraping with Scrapling - HTTP fetching, stealth browser automation, Cloudfl
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos, windows |
|
||||
| Tags | `Web Scraping`, `Browser`, `Cloudflare`, `Stealth`, `Crawling`, `Spider` |
|
||||
| Related skills | [`duckduckgo-search`](/user-guide/skills/optional/research/research-duckduckgo-search), [`domain-intel`](/user-guide/skills/optional/research/research-domain-intel) |
|
||||
| Related skills | [`duckduckgo-search`](/docs/user-guide/skills/optional/research/research-duckduckgo-search), [`domain-intel`](/docs/user-guide/skills/optional/research/research-domain-intel) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@ Free meta-search via SearXNG — aggregates results from 70+ search engines. Sel
|
||||
| License | MIT |
|
||||
| Platforms | linux, macos |
|
||||
| Tags | `search`, `searxng`, `meta-search`, `self-hosted`, `free`, `fallback` |
|
||||
| Related skills | [`duckduckgo-search`](/user-guide/skills/optional/research/research-duckduckgo-search), [`domain-intel`](/user-guide/skills/optional/research/research-domain-intel) |
|
||||
| Related skills | [`duckduckgo-search`](/docs/user-guide/skills/optional/research/research-duckduckgo-search), [`domain-intel`](/docs/user-guide/skills/optional/research/research-domain-intel) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
@@ -0,0 +1,337 @@
|
||||
---
|
||||
title: "Web Pentest"
|
||||
sidebar_label: "Web Pentest"
|
||||
description: "Authorized web application penetration testing — reconnaissance, vulnerability analysis, proof-based exploitation, and professional reporting"
|
||||
---
|
||||
|
||||
{/* This page is auto-generated from the skill's SKILL.md by website/scripts/generate-skill-docs.py. Edit the source SKILL.md, not this page. */}
|
||||
|
||||
# Web Pentest
|
||||
|
||||
Authorized web application penetration testing — reconnaissance, vulnerability
|
||||
analysis, proof-based exploitation, and professional reporting. Adapts
|
||||
Shannon's "No Exploit, No Report" methodology with hard guardrails for
|
||||
scope, authorization, and aux-client leakage. Active testing against running
|
||||
applications you own or have written authorization to test.
|
||||
|
||||
## Skill metadata
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| Source | Optional — install with `hermes skills install official/security/web-pentest` |
|
||||
| Path | `optional-skills/security/web-pentest` |
|
||||
| Platforms | linux, macos |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
:::info
|
||||
The following is the complete skill definition that Hermes loads when this skill is triggered. This is what the agent sees as instructions when the skill is active.
|
||||
:::
|
||||
|
||||
# Web Application Penetration Testing
|
||||
|
||||
A phased pentesting workflow for running web applications. Adapted from
|
||||
Shannon's pipeline (Keygraph, AGPL — concepts only, no code borrowed).
|
||||
Built around three rules:
|
||||
|
||||
1. No exploit, no report — every finding requires reproducible evidence.
|
||||
2. Bounded scope — every active request goes against a target the operator
|
||||
pre-declared. Off-scope hosts are refused.
|
||||
3. Bypass exhaustion before false-positive dismissal — a "blocked" payload
|
||||
is not a clean bill of health until you've tried the bypass set.
|
||||
|
||||
---
|
||||
|
||||
## ⚠️ Hard Guardrails — Read Before Every Engagement
|
||||
|
||||
Violating any of these invalidates the engagement and may be illegal.
|
||||
|
||||
1. **Authorization gate.** Before the first active scan in a session, you
|
||||
MUST confirm with the user, in writing, that they own or have written
|
||||
authorization to test the target. Record the acknowledgement in
|
||||
`engagement/authorization.md` (see template). No acknowledgement → no
|
||||
active scanning. Reading public pages with `curl` is fine; sending
|
||||
payloads is not.
|
||||
|
||||
2. **Scope allowlist.** Maintain `engagement/scope.txt` — one hostname or
|
||||
CIDR per line. Every `nmap`, `curl`, `whatweb`, browser navigation, or
|
||||
payload-bearing request MUST be against an entry in scope. If a target
|
||||
redirects you off-scope (3xx to a different host, a link in HTML),
|
||||
STOP and confirm with the user before following.
|
||||
|
||||
3. **No production systems without paper.** If the user hasn't told you
|
||||
"yes, prod is in scope and I have written sign-off," assume not. Default
|
||||
targets are staging, local docker, dedicated test instances.
|
||||
|
||||
4. **Cloud metadata is off by default.** Do not probe `169.254.169.254`,
|
||||
`metadata.google.internal`, `100.100.100.200`, `[fd00:ec2::254]`, or
|
||||
equivalent unless the engagement explicitly includes SSRF-to-metadata
|
||||
as a goal AND the target is one you control. The agent's browser tool
|
||||
can reach these from inside your own infrastructure — don't.
|
||||
|
||||
5. **Destructive payloads need approval.** SQLi payloads that DROP/DELETE,
|
||||
filesystem-write SSTI, command injection with `rm`/`shutdown`/`mkfs`,
|
||||
anything that mutates beyond a single test row → ASK FIRST. The
|
||||
`approval.py` system catches some; don't rely on it alone.
|
||||
|
||||
6. **Aux-client leakage risk (Hermes-specific).** This skill produces
|
||||
sessions full of SQLi/XSS/RCE payloads, captured credentials, JWT
|
||||
tokens. Hermes' compression and title-generation paths replay history
|
||||
through the auxiliary client (often the main model). Anything sensitive
|
||||
you write to the conversation can leave the box on the next compress.
|
||||
Mitigation:
|
||||
- Redact captured tokens/credentials to the LAST 6 CHARS before logging
|
||||
them in any message. Full values go to `engagement/evidence/` files,
|
||||
never into chat history.
|
||||
- If the engagement is sensitive, set `auxiliary.title_generation.enabled: false`
|
||||
in `~/.hermes/config.yaml` for the session.
|
||||
|
||||
7. **Rate limit yourself.** Default 200ms between active requests against
|
||||
any single host. The recon-scan.sh script enforces this. Don't bypass
|
||||
it without operator approval.
|
||||
|
||||
8. **Authority of the report.** This skill produces a security
|
||||
assessment, not a "PASS." Even a clean run is "no exploitable issues
|
||||
FOUND in scope X within time T using methods Y" — not "the application
|
||||
is secure." Mirror that language in the report.
|
||||
|
||||
---
|
||||
|
||||
## Phase 0: Engagement Setup
|
||||
|
||||
Before any scanning happens, create the engagement directory and
|
||||
authorization acknowledgement.
|
||||
|
||||
```bash
|
||||
ENGAGEMENT=engagement-$(date +%Y%m%d-%H%M%S)
|
||||
mkdir -p "$ENGAGEMENT"/{evidence,findings,reports}
|
||||
cd "$ENGAGEMENT"
|
||||
```
|
||||
|
||||
1. **Ask the user (verbatim):**
|
||||
> "Confirm: (a) the target URL is [X], (b) you own this application
|
||||
> or have written authorization to test it, and (c) the engagement
|
||||
> may run for up to [N] hours starting now. Reply 'authorized' to
|
||||
> proceed."
|
||||
|
||||
2. **Wait for explicit `authorized` response.** Any other answer means STOP.
|
||||
|
||||
3. **Record authorization** to `engagement/authorization.md` using the
|
||||
template in `templates/authorization.md`. Include:
|
||||
- Target URL(s) and IP(s)
|
||||
- Authorization basis (ownership / written authz from $name)
|
||||
- Engagement window
|
||||
- Out-of-scope items (production, third-party services, etc.)
|
||||
- Operator name (the user driving this session)
|
||||
|
||||
4. **Build scope.txt:**
|
||||
```
|
||||
localhost
|
||||
127.0.0.1
|
||||
staging.example.com
|
||||
192.168.1.0/24 # internal lab only, with operator OK
|
||||
```
|
||||
|
||||
5. **Read** `references/scope-enforcement.md` before issuing the first
|
||||
active request — that doc has the host-extraction rules you apply
|
||||
to every command/URL before it goes out.
|
||||
|
||||
---
|
||||
|
||||
## Phase 1: Pre-Recon (Code Analysis, optional)
|
||||
|
||||
Skip if no source access (black-box engagement).
|
||||
|
||||
If you have read access to the application source:
|
||||
|
||||
1. **Map the architecture** — framework, routing, middleware stack
|
||||
2. **Inventory sinks** — every `execute(`, `os.system(`, `eval(`,
|
||||
template render, file read/write, redirect target
|
||||
3. **Map auth** — session cookie vs JWT, OAuth flows, password reset,
|
||||
privileged endpoints
|
||||
4. **Identify trust boundaries** — what's authenticated, what's not,
|
||||
what comes from `request.*`
|
||||
5. **Backward taint** from each sink to a request source. Early-terminate
|
||||
when proper sanitization is found (parameterized queries, allowlists,
|
||||
`shlex.quote`, well-known escapers).
|
||||
|
||||
Output: `evidence/pre-recon.md` — architecture map, sink inventory,
|
||||
suspected vulnerable code paths.
|
||||
|
||||
This is OFFLINE work. No traffic to the target.
|
||||
|
||||
---
|
||||
|
||||
## Phase 2: Recon (Live, Read-Only)
|
||||
|
||||
Maps the attack surface. All requests are GETs of public pages, no
|
||||
payloads yet. Still scope-bounded.
|
||||
|
||||
1. **Verify scope.** Resolve every target hostname → IP. Confirm IPs are
|
||||
in scope (avoids the "DNS points somewhere unexpected" trap).
|
||||
|
||||
2. **Network surface** (only if scope permits port scanning):
|
||||
```bash
|
||||
nmap -sT -T3 --top-ports 100 -oN evidence/nmap.txt $TARGET
|
||||
```
|
||||
Use `-T3` (default), not `-T4/-T5`. Stealthier and avoids tripping
|
||||
IDS/IPS in shared environments.
|
||||
|
||||
3. **Tech fingerprint:**
|
||||
```bash
|
||||
whatweb -v $TARGET_URL > evidence/whatweb.txt
|
||||
curl -sIk $TARGET_URL > evidence/headers.txt
|
||||
```
|
||||
|
||||
4. **Endpoint discovery:**
|
||||
- Crawl the app with the browser tool (`browser_navigate`,
|
||||
`browser_get_images`, follow links).
|
||||
- Inspect `robots.txt`, `sitemap.xml`, `.well-known/*`.
|
||||
- Use the developer tools network panel via browser tool to capture
|
||||
XHR/fetch calls.
|
||||
|
||||
5. **Auth surface:** Identify login, registration, password reset,
|
||||
session cookie names, token formats. Do NOT send credentials yet —
|
||||
just observe.
|
||||
|
||||
6. **Correlate with pre-recon** (if you have source). For each
|
||||
`evidence/pre-recon.md` finding, mark whether the live surface
|
||||
confirms it's reachable.
|
||||
|
||||
Output: `evidence/recon.md` — endpoints, technologies, auth model,
|
||||
input vectors.
|
||||
|
||||
---
|
||||
|
||||
## Phase 3: Vulnerability Analysis
|
||||
|
||||
One delegate_task per vulnerability class. Each agent reads
|
||||
`evidence/recon.md` (+ `evidence/pre-recon.md` if present), produces
|
||||
`findings/<class>-queue.json` using `templates/exploitation-queue.json`.
|
||||
|
||||
Use `delegate_task` with these focused subagents (parallel where possible):
|
||||
|
||||
| Class | Goal | Reference |
|
||||
|-------|------|-----------|
|
||||
| `injection` | SQLi, command, path traversal, SSTI, LFI/RFI, deserialization | `references/vuln-taxonomy.md` (slot types) |
|
||||
| `xss` | Reflected, stored, DOM-based | `references/vuln-taxonomy.md` (render contexts) |
|
||||
| `auth` | Login bypass, JWT confusion, session fixation, OAuth flaws | `references/exploitation-techniques.md` |
|
||||
| `authz` | IDOR, vertical/horizontal escalation, business logic | `references/exploitation-techniques.md` |
|
||||
| `ssrf` | Internal reachability, metadata, protocol smuggling | Skip metadata unless explicitly authorized |
|
||||
| `infra` | Misconfig, info disclosure, default creds, exposed admin | `references/exploitation-techniques.md` |
|
||||
|
||||
Each queue entry has: id, vuln class, source (file:line if known),
|
||||
endpoint, parameter, slot type, suspected defense, verdict
|
||||
(`identified` / `partial` / `confirmed` / `critical`), witness payload,
|
||||
confidence (0-1), notes.
|
||||
|
||||
The analysis phase doesn't send malicious payloads yet — it stages them.
|
||||
The exploitation phase actually fires them.
|
||||
|
||||
---
|
||||
|
||||
## Phase 4: Exploitation (Proof-Based, Conditional)
|
||||
|
||||
Only run a sub-agent per class where the analysis queue has actionable
|
||||
entries (`identified` or `partial`).
|
||||
|
||||
For each candidate:
|
||||
|
||||
1. **Pre-send check** — host in scope? auth gate satisfied? payload
|
||||
approved if destructive?
|
||||
2. **Send the witness payload** — minimal proof. SQLi: `' AND 1=1--`
|
||||
then `' AND 1=2--`. XSS: a benign marker like
|
||||
`<svg/onload=console.log("HERMES-PENTEST-XSS")>`. Never `alert(1)` in
|
||||
stored XSS — it'll fire for other users in shared environments.
|
||||
3. **Verify the witness fires** — for blind injection, use a sleep
|
||||
probe (`SLEEP(5)`) and time the response. For SSRF, use a
|
||||
tester-controlled callback host you own (NOT a public service like
|
||||
webhook.site for sensitive engagements — exfil paths).
|
||||
4. **Promote level:**
|
||||
- **L1 Identified** — pattern matched, no behavior change
|
||||
- **L2 Partial** — sink reached, but defense in place
|
||||
- **L3 Confirmed** — payload changed app behavior in observable way
|
||||
- **L4 Critical** — data extracted, code executed, access escalated
|
||||
5. **Bypass exhaustion before classifying as FP.** For each candidate
|
||||
that blocks: try at least the bypass set in
|
||||
`references/bypass-techniques.md` for that class. Only after the set
|
||||
is exhausted may you write `verdict: false_positive`.
|
||||
6. **Record evidence** for every L3/L4:
|
||||
- Full request (method, URL, headers, body)
|
||||
- Response (status, headers, relevant body excerpt)
|
||||
- Reproducer command (curl one-liner)
|
||||
- Impact statement
|
||||
|
||||
Output: `findings/exploitation-evidence.md`
|
||||
|
||||
**Redact in evidence files:**
|
||||
- Any captured credentials/tokens → last 6 chars only in chat;
|
||||
full value to `findings/secrets-vault.md` (gitignored).
|
||||
- Other users' PII → redact.
|
||||
- Your test credentials → fine to keep.
|
||||
|
||||
---
|
||||
|
||||
## Phase 5: Reporting
|
||||
|
||||
Generate the final report using `templates/pentest-report.md`. Sections:
|
||||
|
||||
1. Executive summary
|
||||
2. Engagement scope (from `engagement/scope.txt`)
|
||||
3. Authorization (from `engagement/authorization.md`)
|
||||
4. Findings (L3/L4 only — proof-required). Per finding:
|
||||
- Title, severity (CVSS 3.1), CWE
|
||||
- Affected endpoint(s)
|
||||
- Proof (request + response excerpt)
|
||||
- Reproduction steps
|
||||
- Impact
|
||||
- Remediation
|
||||
5. Not-exploited candidates (L1/L2 with notes on what blocked them)
|
||||
6. Out-of-scope observations
|
||||
7. Methodology / tools used
|
||||
8. Limitations and what was NOT tested
|
||||
|
||||
**Severity policy:** CVSS only for L3/L4. L1/L2 are "candidates pending
|
||||
verification" — don't assign CVSS to unverified findings.
|
||||
|
||||
---
|
||||
|
||||
## When to Stop
|
||||
|
||||
- The user revokes authorization.
|
||||
- A candidate finding clearly impacts production data and you don't have
|
||||
approval for destructive testing — STOP and ask.
|
||||
- The target starts returning 503/429 storms — back off, reconvene with
|
||||
the operator.
|
||||
- You discover something *outside* the contracted scope (e.g. an exposed
|
||||
customer database while testing an unrelated endpoint). STOP, document,
|
||||
report to the operator. Do not pivot without explicit approval — that
|
||||
pivot is what makes pentesting illegal.
|
||||
|
||||
---
|
||||
|
||||
## What This Skill Does NOT Cover
|
||||
|
||||
- Network-layer pentesting beyond port scanning (no Metasploit,
|
||||
Cobalt Strike, AD attacks, network protocol fuzzing).
|
||||
- Reverse engineering / binary analysis (see issue #383).
|
||||
- Source-only static analysis (see issue #382).
|
||||
- Active social engineering / phishing.
|
||||
- Anything against systems the operator hasn't pre-authorized.
|
||||
|
||||
If the engagement needs any of these, escalate to a professional
|
||||
pentester. This skill complements professional pentesting; it does
|
||||
not replace it.
|
||||
|
||||
---
|
||||
|
||||
## Further Reading
|
||||
|
||||
- `references/scope-enforcement.md` — how to bound every active request
|
||||
- `references/vuln-taxonomy.md` — slot types, render contexts, OWASP map
|
||||
- `references/exploitation-techniques.md` — per-class payload patterns
|
||||
- `references/bypass-techniques.md` — common WAF/filter bypasses
|
||||
- `templates/authorization.md` — engagement authorization template
|
||||
- `templates/pentest-report.md` — final report template
|
||||
- `templates/exploitation-queue.json` — per-class finding queue schema
|
||||
- `scripts/recon-scan.sh` — rate-limited nmap+whatweb+headers wrapper
|
||||
+1
-1
@@ -20,7 +20,7 @@ Debug REST/GraphQL APIs: status codes, auth, schemas, repro.
|
||||
| Author | eren-karakus0 |
|
||||
| License | MIT |
|
||||
| Tags | `api`, `rest`, `graphql`, `http`, `debugging`, `testing`, `curl`, `integration` |
|
||||
| Related skills | [`systematic-debugging`](/user-guide/skills/bundled/software-development/software-development-systematic-debugging), [`test-driven-development`](/user-guide/skills/bundled/software-development/software-development-test-driven-development) |
|
||||
| Related skills | [`systematic-debugging`](/docs/user-guide/skills/bundled/software-development/software-development-systematic-debugging), [`test-driven-development`](/docs/user-guide/skills/bundled/software-development/software-development-test-driven-development) |
|
||||
|
||||
## Reference: full SKILL.md
|
||||
|
||||
|
||||
Reference in New Issue
Block a user