wtf is violin?

Violin is an add-on profile for Hermes Agent, an AI agent framework, that turns it into a structured assistant for running authorized penetration tests. Instead of being a standalone scanner, it is a set of playbooks, references, and safety rules that guide the AI through a full pentest engagement: scoping, reconnaissance, vulnerability research, careful exploit validation, and reporting. The profile ships 31 playbooks covering the different phases of a test plus 24 specific vulnerability classes, along with 10 reference documents and 11 report templates. These are organized into three routed skills covering general pentesting, web attacks, and access control issues. Because it runs on top of Hermes, Violin reuses whatever AI provider, model, and tool connections you already have configured there, and it does not introduce its own separate credentials or API keys. Safety is built into the workflow at multiple points. Before any testing begins, the assistant asks a set of nine scoping questions and requires explicit user approval. After that, every command that would actually touch a target has to pass through a required guard plugin called violin-guard, which checks that the command stays inside the agreed scope before it is allowed to run. Additional approval gates sit before active scanning and before any exploitation attempts, and a mandatory retrospective step happens at the end of each engagement. The typical workflow moves through six phases: scoping, reconnaissance, vulnerability research, exploitation, reporting, and a final retrospective. Reporting focuses on reproducible evidence such as screenshots and captured tool output, along with CVSS scoring under both version 3.1 and 4.0, and optional suggested fixes. To use Violin, you install it into an existing Hermes Agent setup with a single install command, then start a session with the profile active. It is intended to run primarily on Kali Linux or Parrot OS, the standard penetration testing distributions, with a Docker-based Kali container supported as a fallback on machines that lack the usual pentest tooling installed. This project is written in Python and released under the MIT License. It is aimed at security professionals and penetration testers who already use Hermes Agent and want a repeatable, scope-respecting process for authorized engagements rather than an unstructured or unsupervised testing tool.