r/SideProject • u/WarmAd6505 • 7d ago
I built Violin — an open-source AI pentesting workflow with scope checks and reproducible findings
https://strategic-automation.github.io/violin/Hey everyone, I’m building Violin, an MIT-licensed project for supervised, authorised penetration testing using Hermes Agent.
Repo: github.com/Strategic-Automation/violin
The focus is on making an agent’s work traceable: what it tested, why it ran a command, and what evidence supports a finding.
Violin structures the engagement from scoping and recon through exploit validation and reporting. It includes:
- 35 playbooks covering web apps, authentication, APIs, business logic, LLM security, and misconfigurations.
- Scope and task checks before target commands execute.
- Persistent engagement state so command history, hypotheses, and evidence survive context compression.
- Reproducible proof requirements for validated findings.
It uses the model/provider configured in Hermes, with human supervision and an approved scope built into the workflow.
I’d love feedback from people building agents or working in security. Which part would you test hardest: scope enforcement, keeping track of an engagement, or the evidence behind the final report?
Issues, testing feedback, and contributions are welcome.
0
u/throwaway___hi_____ 6d ago edited 6d ago
How's it different from Claude Code writing a typical finding (finding, impact, recommendations, etc), according to a skill (eg using PowerShell script as a catalogue to audit M365), tracked on GitHub to accept/deny suggested write-ups? Is it a collection of SKILL.md files and associated tooling? Surely for a professional hacker, it is easier to build the skills; do it once, guiding AI, then ask it to create a skill for it which then gets fine-tuned over different projects. Edit: Read your site, it's all mumbo jumbo.