web-pentest

Web application pentesting requires strict scope enforcement to prevent unauthorized access. This skill applies phase-based guardrails and engagement files to ensure all recon and vulnerability analysis stays within proven authorized boundaries.

Structured evidence capture uses a dedicated pipeline with recon.md files and findings queues. This approach documents the attack surface and potential vulnerabilities systematically through provided templates during the reporting phase.

Phase-driven vulnerability analysis progresses through Pre-Recon, Recon, Vulnerability Analysis, Exploitation, and Reporting. This structured workflow ensures safe procedures by applying hard guardrails at each step to prevent legal issues and data leakage.

Yes, Hermes-guided recon identifies and documents a web application's attack surface. The skill enforces authorization and scope from engagement files to ensure all reconnaissance actions remain safe and compliant.

You need to set up an engagement using provided templates and define authorization scope. This preparatory phase ensures the pentest begins with hard guardrails active to prevent unauthorized access and data leakage.

You should not use automated web pentest workflows without clearly defined engagement scope and authorization files. Bypassing the structured guardrails and evidence pipeline risks unauthorized access and potential legal issues during vulnerability analysis.