mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-04-26 01:01:40 +00:00

docs(website): dedicated page per bundled + optional skill (#14929 )

Generates a full dedicated Docusaurus page for every one of the 132 skills
(73 bundled + 59 optional) under website/docs/user-guide/skills/{bundled,optional}/<category>/.
Each page carries the skill's description, metadata (version, author, license,
dependencies, platform gating, tags, related skills cross-linked to their own
pages), and the complete SKILL.md body that Hermes loads at runtime.

Previously the two catalog pages just listed skills with a one-line blurb and
no way to see what the skill actually did — users had to go read the source
repo. Now every skill has a browsable, searchable, cross-linked reference in
the docs.

- website/scripts/generate-skill-docs.py — generator that reads skills/ and
optional-skills/, writes per-skill pages, regenerates both catalog indexes,
and rewrites the Skills section of sidebars.ts. Handles MDX escaping
(outside fenced code blocks: curly braces, unsafe HTML-ish tags) and
rewrites relative references/*.md links to point at the GitHub source.
- website/docs/reference/skills-catalog.md — regenerated; each row links to
the new dedicated page.
- website/docs/reference/optional-skills-catalog.md — same.
- website/sidebars.ts — Skills section now has Bundled / Optional subtrees
with one nested category per skill folder.
- .github/workflows/{docs-site-checks,deploy-site}.yml — run the generator
before docusaurus build so CI stays in sync with the source SKILL.md files.

Build verified locally with `npx docusaurus build`. Only remaining warnings
are pre-existing broken link/anchor issues in unrelated pages.

2026-04-23 22:22:11 -07:00

5.1 KiB

Raw Blame History

title	sidebar_label	description
Domain Intel — Passive domain reconnaissance using Python stdlib	Domain Intel	Passive domain reconnaissance using Python stdlib

{/* This page is auto-generated from the skill's SKILL.md by website/scripts/generate-skill-docs.py. Edit the source SKILL.md, not this page. */}

Domain Intel

Passive domain reconnaissance using Python stdlib. Subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, domain availability checks, and bulk multi-domain analysis. No API keys required.

Skill metadata


Source	Optional — install with `hermes skills install official/research/domain-intel`
Path	`optional-skills/research/domain-intel`

Reference: full SKILL.md

:::info The following is the complete skill definition that Hermes loads when this skill is triggered. This is what the agent sees as instructions when the skill is active. :::

Domain Intelligence — Passive OSINT

Passive domain reconnaissance using only Python stdlib. Zero dependencies. Zero API keys. Works on Linux, macOS, and Windows.

Helper script

This skill includes scripts/domain_intel.py — a complete CLI tool for all domain intelligence operations.

# Subdomain discovery via Certificate Transparency logs
python3 SKILL_DIR/scripts/domain_intel.py subdomains example.com

# SSL certificate inspection (expiry, cipher, SANs, issuer)
python3 SKILL_DIR/scripts/domain_intel.py ssl example.com

# WHOIS lookup (registrar, dates, name servers — 100+ TLDs)
python3 SKILL_DIR/scripts/domain_intel.py whois example.com

# DNS records (A, AAAA, MX, NS, TXT, CNAME)
python3 SKILL_DIR/scripts/domain_intel.py dns example.com

# Domain availability check (passive: DNS + WHOIS + SSL signals)
python3 SKILL_DIR/scripts/domain_intel.py available coolstartup.io

# Bulk analysis — multiple domains, multiple checks in parallel
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com google.com
python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns

SKILL_DIR is the directory containing this SKILL.md file. All output is structured JSON.

Available commands

Command	What it does	Data source
`subdomains`	Find subdomains from certificate logs	crt.sh (HTTPS)
`ssl`	Inspect TLS certificate details	Direct TCP:443 to target
`whois`	Registration info, registrar, dates	WHOIS servers (TCP:43)
`dns`	A, AAAA, MX, NS, TXT, CNAME records	System DNS + Google DoH
`available`	Check if domain is registered	DNS + WHOIS + SSL signals
`bulk`	Run multiple checks on multiple domains	All of the above

When to use this vs built-in tools

Use this skill for infrastructure questions: subdomains, SSL certs, WHOIS, DNS records, availability
Use web_search for general research about what a domain/company does
Use web_extract to get the actual content of a webpage
Use terminal with curl -I for a simple "is this URL reachable" check

Task	Better tool	Why
"What does example.com do?"	`web_extract`	Gets page content, not DNS/WHOIS data
"Find info about a company"	`web_search`	General research, not domain-specific
"Is this website safe?"	`web_search`	Reputation checks need web context
"Check if a URL is reachable"	`terminal` with `curl -I`	Simple HTTP check
"Find subdomains of X"	This skill	Only passive source for this
"When does the SSL cert expire?"	This skill	Built-in tools can't inspect TLS
"Who registered this domain?"	This skill	WHOIS data not in web search
"Is coolstartup.io available?"	This skill	Passive availability via DNS+WHOIS+SSL

Platform compatibility

Pure Python stdlib (socket, ssl, urllib, json, concurrent.futures). Works identically on Linux, macOS, and Windows with no dependencies.

crt.sh queries use HTTPS (port 443) — works behind most firewalls
WHOIS queries use TCP port 43 — may be blocked on restrictive networks
DNS queries use Google DoH (HTTPS) for MX/NS/TXT — firewall-friendly
SSL checks connect to the target on port 443 — the only "active" operation

Data sources

All queries are passive — no port scanning, no vulnerability testing:

crt.sh — Certificate Transparency logs (subdomain discovery, HTTPS only)
WHOIS servers — Direct TCP to 100+ authoritative TLD registrars
Google DNS-over-HTTPS — MX, NS, TXT, CNAME resolution (firewall-friendly)
System DNS — A/AAAA record resolution
SSL check is the only "active" operation (TCP connection to target:443)

Notes

WHOIS queries use TCP port 43 — may be blocked on restrictive networks
Some WHOIS servers redact registrant info (GDPR) — mention this to the user
crt.sh can be slow for very popular domains (thousands of certs) — set reasonable expectations
The availability check is heuristic-based (3 passive signals) — not authoritative like a registrar API

Contributed by @FurkanL0

5.1 KiB Raw Blame History