Kartoos

Hermes offensive security agent — 58 skills + trust kernel

Kartoos is a drop-in offensive-security capability for the Hermes agent. It provides 58 reusable offensive-security skills (recon, web, AD, network, cloud, privesc, exploitation) plus a trust kernel that enforces authorization, scope checking, gating, and append-only audit logging.

Quick Start

git clone https://github.com/kartikshinde/kartoos.git
cd kartoos
./install.sh

Or one-liner:

curl -fsSL https://raw.githubusercontent.com/kartikshinde/kartoos/main/install.sh | bash

What's Included

• 58 skills covering reconnaissance, webapp testing, active directory, network services, privilege escalation, password attacks, post-exploitation, cloud/container security, and CI/CD pipelines
• Policy Gateway — authorization engine with scope matching (hosts, domains, CIDRs), action classification, and allow/block/hard_gate decisions
• Command Executor — wraps every command with pre-flight auth, credential redaction, and automatic event logging
• Append-Only Ledgers — events.jsonl + gates.jsonl with tamper-evident IDs
• Engagement Workspace — per-engagement directory layout with authorization, artifacts, views, and checkpoints
• Skill Staging — patch proposals are staged, never silently mutated

Usage

# Create a new engagement
python3 -m hermes_offsec.core.init_engagement --id eng-2026-06-target --operator Kartik

# Set your authorization and scope
cp templates/authorization.yaml.template ~/.hermes/engagements/eng-2026-06-target/authorization.yaml
# Edit the authorization.yaml with your scope

# Run a command (pre-flighted against Policy Gateway)
python3 -m hermes_offsec.core.executor \
  ~/.hermes/engagements/eng-2026-06-target/authorization.yaml \
  ~/.hermes/engagements/eng-2026-06-target \
  --cmd "nmap -sS 10.0.0.1" --target "10.0.0.1" --action-class active_recon

Skill Gate Distribution

Gate	Count	Example Domains
None	7	Passive recon, support skills
Soft	42	Web, AD, cloud, network recon
Hard	9	Exploitation, privesc, password attacks, pivoting

Requirements

• Python 3.10+
• Hermes agent (for skill loading)
• pip (for trust kernel installation)

License

AGPL-3.0