hermes-opencti-redteam-skill-setup

Files (1)

• SKILL.md

SKILL.md (first lines)

# Hermes OpenCTI red-team skill setup

## Overview

This skill captures the repeatable setup for making the community skill
`redteam-threat-exploits` usable in a local Hermes environment. It installs the
skill from GitHub, wires `OPENCTI_URL` and `OPENCTI_TOKEN` into the target
Hermes profile, patches the installed skill when the host's OpenCTI base URL is
known to differ from the upstream default, and adds a small wrapper command so
future use does not require manual environment preparation.

Use this when setting up a new host or Hermes profile for threat-informed red
team workflows backed by a local OpenCTI deployment.

## When to Use

- You want `redteam-threat-exploits` available in Hermes on a local machine.
- Hermes should automatically know the local OpenCTI URL and token.
- You want a repeatable launcher such as `hermes-redteam-threats`.
- You are moving this workflow to another Hermes profile or another operator
  workstation.

Do not use this when:
- The user only wants to inspect the upstream repo without installing it.
- The target OpenCTI instance is remote and the local host assumptions below do
  not apply.
- The user has not authorized copying an OpenCTI token into the target Hermes
  profile.

## Assumptions for this host

On this host, local OpenCTI is reachable at:
- `http://127.0.0.1:8088`

The deployed OpenCTI secrets currently live under:
- `/home/lost0x01/services/opencti-deploy/.env`

The default Hermes profile paths are:
- `~/.hermes/config.yaml`
- `~/.hermes/.env`

## Setup steps

1. Install or update the source repo locally.

```bash
git clone https://github.com/mochiCoon/redteam-threat-exploits.git ~/github/redteam-threat-exploits
```

If the repo already exists, update it instead:

```bash
git -C ~/github/redteam-threat-exploits pull --ff-only
```

2. Add the repo as a Hermes skill tap.

```bash
hermes skills tap add mochiCoon/redteam-threat-exploits
```

3. Install the skill from the raw GitHub `SKILL.md` URL.

```bash
hermes skills install \
  https://raw.githubusercontent.com/mochiCoon/redteam-threat-exploits/main/SKILL.md \
  --category red-teaming \
  --yes
```

4. Verify the skill is installed.

```bash
hermes skills list | grep -i redteam-threat-exploits
```

5. Back up the target Hermes profile env file before editing.

```bash
cp ~/.hermes/.env ~/.hermes/.env.pre-opencti-redteam-setup.$(date +%Y%m%d%H%M%S).bak
```

6. Populate `OPENCTI_URL` and `OPENCTI_TOKEN` in `~/.hermes/.env`.

Recommended values for this host:
- `OPENCTI_URL=http://127.0.0.1:8088`
- `OPENCTI_TOKEN=<value sourced from /home/lost0x01/services/opencti-deploy/.env>`

Do not print the token into chat or logs. Read it from the deploy env and write
it directly into the target Hermes profile env.

7. Patch the installed skill if the upstream instructions assume the wrong local
base URL.

Target file:
- `~/.hermes/skills/red-teaming/redteam-threat-exploits/SKILL.md`

Adjust Step 1 so it prefers `http://127.0.0.1:8088` when `OPENCTI_URL` is
unset, while still requiring a real token.

8. Create a reusable launcher in `~/.local/bin/hermes-redteam-threats`.

Recommended wrapper behavior:
- load `~/.hermes/.env`
- if `OPENCTI_TOKEN` is missing, source `~/services/opencti-deploy/.env`
- export `OPENCTI_TOKEN` from `OPENCTI_ADMIN_TOKEN` when available
- default `OPENCTI_URL` to `http://127.0.0.1:8088`
- exec `hermes -s redteam-threat-exploits "$@"`
- support a `--check` mode that prints only non-secret health data

Reference wrapper:

```bash
#!/usr/bin/env bash
set -euo pipefail

HERMES_ENV="$HOME/.hermes/.env"
DEPLOY_ENV="$HOME/services/opencti-deploy/.env"
DEFAULT_OPENCTI_URL="http://127.0.0.1:8088"

From lost0x01/Full-RAIccoon-Package, MIT.

More from lost0x01/Full-RAIccoon-Package