Authorized web application penetration testing — reconnaissance, vulnerability analysis, proof-based exploitation, and professional reporting. Adapts Shannon's "No Exploit, No Report" methodology with hard guardrails for scope, authorization, and aux-client leakage. Active testing against running applications you own or have written authorization to test.
Install
npx skills add NousResearch/hermes-agent --skill web-pentestnpx skills add NousResearch/hermes-agent --skill web-pentest -a claude-code -gnpx skills add NousResearch/hermes-agent --skill web-pentest -a codex -ggemini skills install https://github.com/NousResearch/hermes-agent.git --path optional-skills/security/web-pentestgh skill install NousResearch/hermes-agent web-pentestgit clone --depth 1 https://github.com/NousResearch/hermes-agent /tmp/NousResearch__hermes-agent
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/NousResearch__hermes-agent/optional-skills/security/web-pentest ~/.claude/skills/web-pentest # Claude Code
cp -R /tmp/NousResearch__hermes-agent/optional-skills/security/web-pentest ~/.agents/skills/web-pentest # Codex, Cursor, Gemini CLI, Copilot, OpenCode