Violin ☤ — Supervised Agentic Hermes Pentest Profile

35 playbooks · 19 references · 14 templates · required execution guard · Hermes-native

Violin is a Hermes-native agentic pentest profile for supervised, authorised penetration tests — from reconnaissance through safe exploit validation to reporting. It uses Hermes' built-in toolsets, seven routed skills, and the required violin_guard plugin at the target-execution boundary. The standalone CLI supports release checks, diagnostics, and administrative recovery; target commands run through the plugin. Violin adds no profile-specific credentials and inherits the provider and tool backends already configured in Hermes.

Quick start · Workflow · Guard tools · Benchmarks · Landing page · Discussions · Development

Following Violin? Star the repository to keep it easy to find and help other security engineers discover supervised agentic pentesting.

Community discovery

Violin is listed in community-curated collections including awesome-ai-security, awesome-hermes-skills, awesome-hermes-agent, and awesome-infosec.

Third-party coverage: Starlog technical analysis and “Violin: Supervised Agentic Penetration Testing Profile for Hermes Agent”.

For independent evaluation, use the reviewer kit, which collects the benchmark path, known limits, review context, and a factual comparison with autonomous pentest-agent designs.

---

Guarded target execution	Scope, phase, PTT, skill, hypothesis, history, and synchronization checks run before a target command starts.
Persistent engagement state	PTT tasks, hypotheses, command history, checkpoints, evidence, and reports survive context compression.
Evidence-backed findings	A typed submission binds each validated finding to authenticated execution receipts.
Routed methodology	A pentest orchestrator selects focused web, identity, API, business-logic, LLM-security, and misconfiguration playbooks.
Bounded execution	Single commands, command bursts, background processes, batch review, heartbeat checks, and cancellation share one state model.
Verifiable releases	Plugin registration, schemas, skill snapshots, documentation contracts, lint, formatting, and the full test suite are release-gated.

Quick start

Install the profile

hermes profile install https://github.com/Strategic-Automation/violin
hermes -p violin plugins disable violin_guard
hermes -p violin plugins enable violin_guard --no-allow-tool-override
hermes -p violin

Guard dependencies are declared in plugins/violin_guard/plugin.yaml. The plugin name, directory, and enabled configuration all use violin_guard, so Hermes can resolve its dependencies without a directory workaround. Installing dependencies into the development .venv does not install them into Hermes. The disable/enable cycle above forces dependency admission even when the profile configuration already enables the plugin. Verify registration after installation:

hermes -p violin plugins doctor ~/.hermes/profiles/violin/plugins/violin_guard --ci
hermes -p violin tools list

Plugin Doctor should report 12 tools and 5 hooks, and violin_guard should appear as an enabled toolset. Restart Hermes after installation before starting an engagement. Reinstall the profile to migrate an older violin-guard installation.

Then start with an authorized target and let Violin collect the scope before any target interaction:

Run an authorized penetration test against example.com.

Requirements

• Hermes Agent 0.21.5 or newer (container pins the v2026.9.24 release commit)
• Python 3.11 and uv for local development
• Kali Linux or Parrot OS for the expected security-tool environment
• Written authorization and an approved scope

Violin does not select a model or provider. Configure those in Hermes. For a capable default, use Qwen3.8 27B locally or DeepSeek V4 Flash through a hosted provider.

Engagement lifecycle

flowchart LR
    S[Scope] --> R[Recon]
    R --> V[Vulnerability research]
    V --> E[Exploit validation]
    E --> P[Reporting]
    P --> X[Retrospective]

    G[Violin Guard] -. validates .-> R
    G -. validates .-> V
    G -. validates .-> E

1. Initialize the engagement and approve scope/scope.yaml.
2. Select one active PTT task and its routed skill with violin_record_ptt.
3. Run target commands with violin_exec or violin_exec_burst.
4. Update hypotheses as evidence changes their status.
5. Review each bounded command batch with violin_review_batch.
6. Submit validated findings and generate the final report.
7. Complete the retrospective.

The complete phase model is:

SCOPING → RECON → VULN_RESEARCH → EXPLOITATION
         → POST_EXPLOITATION / PRIVESC / FLAGS
         → REPORTING → RETROSPECTIVE

Starting work in a new phase requires a PTT task under that phase. Existing tasks are not moved between phase sections.

Guard tools

The plugin registers twelve Hermes tools from one typed registry: