Skill library
What a skill provides, the 39 research categories, how the agent finds and uses skills, and how skills and tools work together.
Hunt Web combines security tools that perform assessment operations with a skill library that guides investigation. The research library contains 569 skills in 39 categories, accompanied by one separate Hermes Run-control skill.
These components have different responsibilities. A tool retrieves a page, examines an API, analyzes a file, or records a response. A skill explains how to approach a security question, establish a useful comparison, and assess the resulting evidence. Hermes connects follow-up instructions to the selected Run and its saved work.
This page explains the research categories, how guidance is loaded, the role of the Hermes control skill, and how the components work together during an assessment. The installed tool groups, API keys, and readiness checks are explained in Scanning Tools.
Counts refer to the package inspected on 14 October 2026. They describe package contents and installer coverage, rather than the number of tools or skills executed during a particular scan.
- 570
- Skill documents in total
- 569
- Research skills
- 39
- Research categories
- 749
- Alias entries
1. What a Skill Provides
A skill is a structured research document that supplies guidance for a particular security topic or assessment task. Depending on the topic, it can contain prerequisites, a testing approach, examples, evidence requirements, interpretation guidance, and common limitations. The runtime makes this material available to the agent when relevant to the investigation.
For example, a session-management skill helps frame questions about session continuity and account state. An authorization skill helps establish which account owns an object and which comparison would demonstrate an access boundary. A workflow skill helps examine state changes across several application actions.
Reading a skill does not run anything
These documents guide reasoning and test selection. Actual requests, Browser actions, file analysis, and evidence collection happen through execution tools. Reading a skill does not itself run its example commands or contact a target.
2. Skill Inventory and Counting
The package contains 570 SKILL.md files:
| Library | Count | Role |
|---|---|---|
| Research skills | 569 | Assessment guidance organized into 39 categories, available to the scanner's skill-discovery functions. |
| Hermes Run-control skill | 1 | Guidance for connecting a conversation to an existing Run's status, instructions, continuation, results, and reports. |
| Total skill documents | 570 | Research and control documents combined. |
The library also has 749 alias entries for alternative lookup names. Aliases refer to existing guidance and do not add 749 more skills. Chat Templates and tool command aliases are likewise outside the skill-document count.
3. Core Web, API, and Identity Categories
Several categories are especially relevant to ordinary web assessments. They help move from a discovered endpoint to a meaningful question about access, input handling, or application state.
Web application security
Web application security — 96 skills. This is the largest category. Its guidance covers topics such as authentication, session management, access control, injection, XSS, SSRF, browser behavior, and business logic. The corpus also includes guidance on stateful workflow invariants and reconciling web evidence. These topics matter when an apparent response difference must be checked against normal behavior and the application's actual state.
API security
API security — 28 skills. This category covers API-specific authorization, object and property access, authentication, token handling, GraphQL, and interface discovery. Object-level authorization guidance, for example, helps define an account's legitimate access before comparing requests involving another account's object. Schema or endpoint discovery supplies possible tests; authorization guidance explains what those tests need to establish.
Identity and access management
Identity and access management — 36 skills. These documents address identity boundaries, account controls, federation, and related authorization systems. Their relevance depends on the application and its identity setup. For a Greybox assessment, the important practical distinction is between a session being accepted and that session being entitled to perform a specific action or read a specific object.
Reconnaissance
Reconnaissance — 3 skills. This smaller category provides focused guidance for discovery, including API discovery and JavaScript analysis. It complements the discovery tools by helping interpret which routes and application references deserve further investigation.
4. Broader Assessment and Infrastructure Categories
The library extends beyond browser-facing vulnerabilities. That broader material can help interpret infrastructure, prioritize observations, or explain conditions surrounding an application.
Cloud security
Cloud security — 63 skills. Topics include cloud permissions, configuration, exposed storage, and investigation of cloud-service activity. Such guidance may be relevant when application evidence points to a storage service or identity integration. Access to a web application alone does not provide the cloud permissions needed for every procedure in these documents.
Network services and network security
Network services pentesting — 36 skills and network security — 23 skills. These categories address exposed protocols, service assessment, traffic analysis, and network controls. They complement tools such as Nmap, Naabu, TLSX, and protocol clients when the relevant network service is part of the assessment.
Container security
Container security — 29 skills. Guidance covers container images, workloads, runtime behavior, and Kubernetes-related investigation. The material provides useful context for container-backed applications, while procedures requiring image, host, or cluster access depend on those inputs being available.
Penetration testing and red teaming
Penetration testing — 25 skills and red teaming — 27 skills. These categories provide broader investigation methods and adversarial assessment techniques. They form part of the research library; their inclusion does not create a separate automated red-team deployment mode in the Dashboard.
Vulnerability management
Vulnerability management — 25 skills. This category focuses on assessment, prioritization, remediation, and tracking. Its guidance is useful for interpreting a set of findings and connecting technical observations to follow-up work.
5. Complete Category Map
The following table lists all 39 research categories, with representative subject areas. It summarizes the library without listing all 569 skill names. Categories describing a platform or product represent available guidance; execution also requires the corresponding access and tool support.
6. How the Agent Finds and Uses Skills
Hunt Web provides runtime functions for listing, searching, and reading the research library. The agent can use category information and a search query to locate guidance relevant to the evidence already collected.
A typical sequence is:
- 1Identify the questionApplication behavior suggests an area to investigate.
- 2Locate relevant guidanceListing and search return names, categories, and descriptions.
- 3Read the selected documentThe full guidance loads and its use is recorded in the Run's research artifacts.
- 4Apply it to the applicationChoose tests that fit the endpoint, account context, and tools.
- 5Review the evidenceA supported candidate, an inconclusive outcome, or another question.
- Identify the question. Application behavior suggests an area to investigate, such as object ownership, session continuity, or an API schema.
- Locate relevant guidance. The skill listing and search functions return matching names, categories, and descriptions.
- Read the selected document. The skill-reading function loads the full guidance and records its use in the Run's research artifacts.
- Apply it to the observed application. The agent selects tests that fit the endpoint, account context, and available execution tools.
- Review the evidence. Results can lead to a supported candidate, an inconclusive outcome, or another research question.
Search results are descriptions rather than the complete skill text. Reading the full document is a separate operation. The runtime can reuse a previously loaded skill when its reference remains in the current context and can reload it when the relevant context has been removed. This supports access to useful guidance without loading the entire corpus into every model conversation.
The researcher chooses guidance during the assessment; the Dashboard operator does not need to manually open hundreds of skill files. The relevance and quality of the resulting test still depend on the selected model, available evidence, and execution conditions.
7. Research Skills, Profiles, and Hermes Control
The scan modes category contains guidance for Quick, Standard, and Deep. All three profiles share the research library. Profile selection changes the assessment's breadth and budget rather than replacing the library with a different set of skills. Recent updates expand the Quick, Standard, and Deep guidance for connecting observations, hypotheses, comparisons, and next tests; see What's new.
The separate hunt-web-run-control skill serves another purpose. It guides
Hermes in working with an existing Hunt Web Run: reading status and saved
results, conveying a follow-up instruction, continuing eligible work, and
retrieving report information. The research runtime performs the associated
application testing and evidence workflow.
A request to summarize earlier findings and a request to continue testing can therefore use the same conversation while producing different actions. The first reads saved assessment context; the second can direct further work. The selected Run supplies the relevant assessment context.
Chat Templates are ready-to-copy instructions for these conversations. They help express a goal such as reviewing saved results or investigating cross-account access. They are message templates, so they do not increase the research skill count or install additional scanning tools.
8. Example: Investigating Access to a Shared Document
Consider a controlled document-sharing application with two configured accounts. The assessment question is whether one account can access a private document belonging to the other. The following example illustrates how the components contribute; it is not a claim about a measured scan result.
- 1Discover the workflowObserve document lists, detail requests, and identifiers.
- 2Establish normal accessRecord each account's own document access.
- 3Compare account behaviorComparable requests with each account's context; evidence is stored.
- 4Review the candidateVerification examines the supporting requests and controls.
- 5Save and continueFindings and Report expose saved outcomes; Hermes can continue.
| Stage | Contribution from tools or runtime | Contribution from skills |
|---|---|---|
| Discover the workflow | Browser or HTTP operations observe document lists, detail requests, and identifiers. | Discovery guidance helps distinguish application routes from unrelated references. |
| Establish normal access | Requests record each account's own document access and the associated response. | Authorization guidance helps define ownership and the expected boundary. |
| Compare account behavior | The runtime performs comparable requests with the appropriate account context and stores evidence. | API and access-control guidance helps distinguish unintended access from public sharing or an incorrect baseline. |
| Review the candidate | Verification examines the supporting requests, controls, and observed data or state. | Evidence guidance helps identify missing comparisons and limits on the conclusion. |
| Save and continue | Findings and Report expose saved outcomes; Hermes can read them or request further investigation. | The Hermes control skill connects follow-up instructions to the existing Run. |
A successful login is not authorization
A successful login check establishes account access. It does not establish that document authorization is correct. Conversely, an unexpected response requires interpretation before being reported as a finding. Tools provide observations, while skills help organize the comparisons needed to understand them.
The practical record of coverage is the Run's executed work and saved evidence. A large library provides available guidance, while verified findings depend on what the assessment actually tested and demonstrated. Automated verification also remains distinct from human review.
For the surrounding workflow, continue with Scanning Features and Workflow, Hermes Chat and Templates, and Findings, Results, and Reports.