hermes-skills

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

Use when you have a written implementation plan to execute in a separate session with review checkpoints

Use when a task is multi-step, may span context resets or sessions, uses subagents, or risks losing state before completion.

Use when the user asks to create, write, update, amend, supersede, or evaluate an ADR, architecture decision record, durable architecture decision, decision log, or baseline sync after architecture-changing work.

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Use when strict TDD is explicitly requested, or when an approved atomic implementation task has already chosen TDD Route strict.

Use when the user says `aegis:update`, asks to update or upgrade an installed Aegis method-pack, wants the latest Aegis version, or asks whether Aegis is current on this host.

Use when starting a turn or checking Aegis skill routing.

Use when about to claim work is complete, fixed, passing, verified, release-ready, or ready to commit, merge, publish, or hand off.

Use when you have a spec or requirements for a multi-step task, before touching code

Use when creating new skills, editing existing skills, or verifying skills work before deployment

Use when operating Apple/macOS local apps and device workflows from Hermes: Notes, Messages/iMessage/SMS, Find My, GUI desktop automation, or other AppleScript/CLI-backed macOS tasks.

Apple Reminders via remindctl: add, list, complete.

在 macOS 上从 Hermes/terminal 干净启动 Chrome CDP，避免被 benign ERROR 日志与重复实例误导。

中文关键词触发 open-computer-use MCP 工具。提供截屏、点击、输入等操作的中文别名。

Locate, inspect, and safely edit config/data for sandboxed macOS apps that store state under ~/Library/Containers and ~/Library/Group Containers instead of an obvious config.yaml. Use when an App Store/Flutter/Electron app hides the active config behind bundle IDs, JSON controller files, runtime-generated profiles, or subscription-managed sources.

Use when delegating implementation, refactoring, PR review, or long-running coding work to external coding-agent CLIs such as Claude Code, Codex, OpenCode, or a Kanban-isolated agent lane.

Install and configure hermes-a2a plugin for agent-to-agent communication. Based on Google's A2A protocol. When user says "a2a"、"agent对话"、"agent通信"、 "给agent发消息"、"跟别的agent说话"、"agent间通信"时加载。

Complete guide to using and extending Hermes Agent — CLI usage, setup, configuration, spawning additional agents, gateway platforms, skills, voice, tools, profiles, and a concise contributor reference. Load this skill when helping users configure Hermes, troubleshoot issues, spawn agent instances, or make code contributions.

Route for Spice decision runtime and `spice-hermes-bridge`. Use when the task mentions Spice, spice-runtime, Spice decision layer, spice-hermes-bridge, or Chinese triggers such as Spice 决策层、Spice 决策运行时、决策层 runtime.

Use when a user is designing AI-native systems such as AI chat products, AI gateways, RAG knowledge bases, agent or workflow platforms, inference serving, or vector databases and wants architecture choices and trade-offs grounded in the awesome-architecture templates.

Use when a user needs architecture-first framing before implementation, wants to turn requirements into constraints, quality attributes, trade-offs, C4 views, or ADRs, or wants a guided architecture learning path from the awesome-architecture knowledge base.

Use when a user wants architecture starting points for common non-AI systems such as ecommerce, chat, payment, search, ticketing, storage, mobile apps, or social feeds, and needs components, data flow, trade-offs, bottlenecks, and evolution hints from the awesome-architecture template library.

Use when operating or reviewing santifer/career-ops, an AI job-search command center for job-offer evaluation, tailored CV/PDF generation, application tracking, portal scanning, batch processing, interview prep, and follow-up workflows.

生成单文件的交互式数据结构/算法可视化 HTML 教学页面。适用场景：用户提供 PDF/教材要求生成知识点讲解、给出主题要求做动画演示（如"演示快排"、"做个队列动画"）、提供代码或算法要求可视化执行过程、要求对比两个概念或解释原理。即使用户没有明确说"HTML"或"可视化"，只要涉及"知识点总结"、"教学页面"、"动画演示"、"算法执行过程"、"PDF 讲解"、"SVG 图示"、"逐步执行"等场景也应触发。

Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud bucket permutations, JS guess-paths, vendor product fingerprints for Citrix/F5/Pulse/Fortinet/Cisco/PaloAlto/VMware/Exchange, cloud-native service fingerprints, container/K8s exposure paths, CI/CD platform paths, documentation/wiki leak paths, WHOIS/RDAP, DNS record catalog, Wayback CDX recipes), 43+-pattern secret-regex catalog (incl. modern AI API keys: Anthropic/OpenAI/HuggingFace/Cloudflare/DigitalOcean/npm/PyPI/Docker Hub/Atlassian/DataDog/Sentry/ngrok), 80+ dork corpus across 9 categories, GitHub code-search dorks, copy-paste curl/httpie probes for every check, post-discovery enumeration workflows (AWS/GitHub/Slack/JWT/PMAK/Anthropic/OpenAI), endpoint interest scoring rubric (0–100), mobile app ownership confidence, identity-fabric endpoints (Entra/Okta/ADFS/Google/SAML/M365 Teams+Shar

Anthropic Defending Code Reference Harness safety wrapper. Use for questions or operating plans around the vuln-pipeline autonomous vulnerability-discovery harness, sandbox setup, C/C++ ASAN targets, recon/find/grade/report/patch flow, or adapting the reference harness. Reference-only until the user explicitly asks to bring up the Python/Docker runtime.

Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified `vuln-pipeline patch` ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is written as inert diffs for human review. Writes PATCHES/bug_NN/{patch.diff,patch_result.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".

Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model from their answers; "bootstrap" derives a threat model from the code plus past vulnerabilities (CVEs, git history, pentest reports) when no owner is available; "bootstrap-then-interview" chains the two when both owner and codebase are present. All write THREAT_MODEL.md in a shared schema. Use when asked to "threat model", "build a threat model", "map the attack surface", or "what should we be worried about in this codebase".

Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.

Design, implement, and audit inclusive digital products using WCAG 2.2 Level AA standards. Use this skill to generate semantic ARIA for Web and accessibility traits for Web and Native platforms (iOS/Android).

Full-stack diagnostic for agent and LLM applications. Audits the 12-layer agent stack for wrapper regression, memory pollution, tool discipline failures, hidden repair loops, and rendering corruption. Produces severity-ranked findings with code-first fixes. Essential for developers building agent applications, autonomous loops, or any LLM-powered feature.

Head-to-head comparison of coding agents (Claude Code, Aider, Codex, etc.) on custom tasks with pass rate, cost, time, and consistency metrics

Design and optimize AI agent action spaces, tool definitions, and observation formatting for higher completion rates.

Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports.

Add x402 payment execution to AI agents with per-task budgets, spending controls, and non-custodial wallets. Supports Base through agentwallet-sdk and X Layer through OKX Payments / OKX Agent Payments Protocol.

Build an evidence-backed ECC install plan for a specific repo by sorting skills, commands, rules, hooks, and extras into DAILY vs LIBRARY buckets using parallel repo-aware review passes. Use when ECC should be trimmed to what a project actually needs instead of loading the full bundle.

Operate as an agentic engineer using eval-first execution, decomposition, and cost-aware model routing.

Build persistent multi-agent operating systems on Claude Code. Covers kernel architecture, specialist agents, slash commands, file-based memory, scheduled automation, and state management without external databases.

Engineering operating model for teams where AI agents generate a large share of implementation output.