Hermes skill local web security scan

local-web-security-scan

Local-only authorized web security scanner workflow.

Use when

• the user asks to check a website like example.com for security issues locally.
• The scan must run from this Hermes host, without sending scan data to third-party APIs.
• The target project must not receive new libraries or code.

Rules

1. Scan only user-owned or explicitly authorized targets.
2. Pass the target as an argument; do not hardcode project domains.
3. Keep scope same-origin by default. Add subdomains only with explicit --include-subdomains or --allow-host.
4. Private/loopback/link-local targets are blocked by default; use --allow-private-ip only for explicitly authorized local/internal targets.
5. Do not use external vulnerability APIs, SaaS scanners, telemetry, pastebins, webhook.site, Shodan, Censys, NVD API, or remote nuclei template updates.
6. Do not print secrets found in pages/scripts; report redacted evidence only.
7. Use local tools only. Optional tools such as nmap, nikto, or nuclei may run only when explicitly enabled by flags.

Command

python3 scripts/local_web_scan.py https://example.com --out-dir ./scan-output

Useful flags:

--max-pages 20              # crawl limit
--timeout 8                 # per-request timeout
--include-subdomains        # allow discovered subdomains under the root domain
--allow-host api.example.com # additional allowed host
--nmap-top-ports            # optional local nmap service scan, if installed
--nikto                     # optional local nikto scan, if installed
--nuclei-local-templates PATH # optional nuclei using already-local templates only, with update/interactsh disabled
--active-probes             # extra low-impact reflected-param/open-redirect probes
--quality-profile           # recommended: --max-pages 100 --active-probes --nmap-top-ports --nikto
--dry-run                   # show planned scope, no network requests
--allow-private-ip          # required for explicitly authorized localhost/private/internal targets

Recommended local quality scan when nmap and nikto are approved and installed:

python3 scripts/local_web_scan.py https://example.com --quality-profile --out-dir ./scan-output

--quality-profile is the preferred shorthand for deeper local checks: it expands to --max-pages 100 --active-probes --nmap-top-ports --nikto. Keep nuclei separate unless a curated local template directory has already been reviewed.

Output

The script writes:

• report.md — human-readable findings
• report.json — structured findings
• raw/ — sanitized response metadata and snippets. Treat this folder as potentially sensitive and never commit scan outputs.

Interpreting web-analyzer-like tools

External lookups mean contacting third-party vulnerability/data services such as NVD, Exploit-DB mirrors, GitHub advisories, Shodan/Censys-like sources, or package reputation endpoints. Direct requests from this server to the target site are expected and allowed for an active scan; third-party lookup/API calls are not allowed in this local-only workflow.

Local optional scanners

When adding optional scanner binaries, use references/local-only-scanner-tools.md as the policy reference. In short: nmap and nikto are reasonable opt-in local additions; nuclei is allowed only with an already-local curated template directory and must disable update checks and interactsh/OOB behavior (-duc -ni). The crawler should cover same-origin pages and same-origin URLs discovered inside JS bundles, not just the root page.