AI Agent Harnesses: Which One for Which Occasion (and Why My Daily Driver Is Hermes)

If you’ve ever pasted the same “you are now a strict bug bounty triager, do NOT inflate impact” prompt into a chat window for the fifth time in a week, this post is for you.

That was me, not long ago. I’d find a bug, get the LLM to help me write it up, and then spend as much time fixing the AI’s “help” as I would have spent writing the report myself. The model would invent impact I never proved, pad the thing with OWASP essays, and confidently bless a PoC I hadn’t actually finished testing. Fun times.

The problem was never the model. It was the harness around it — and once I understood that, my whole workflow changed. So this post is my field guide: what an AI harness actually is, which one fits which occasion, and why I ended up running my entire security workflow on Hermes Agent. I’ll also show you the trick that sold me on it — porting YesWeHack’s Claude Code plugin into my setup in one afternoon, because skills are just files.

1. What’s an “AI Harness” Anyway?

Everyone argues about which model is smartest. Honestly? That argument is getting boring. Frontier models are interchangeable for most day-to-day work. What actually decides whether an AI assistant is useful — or a liability with a fancy vocabulary — is everything wrapped around the model:

Think of it this way: the model is the engine, the harness is the rest of the car. A 1,000-horsepower engine with no steering wheel isn’t a car — it’s a headline on the evening news.

This matters double in security, because our outputs get replayed line-by-line by a triager. An unsupervised LLM doesn’t just hallucinate — it inflates. “I proved reflected XSS” becomes “full account takeover chain” somewhere between your terminal and the submission form, and now you’re explaining yourself to a triager. Or worse, getting auto-closed.

2. The Lineup

Here’s the honest lay of the land from actually using these things:

Bottom line: Claude Code and Codex are brilliant coding teammates but they’re session-bound. They don’t follow you to your phone, and they don’t remember that the trick you used on Tuesday’s target worked. OpenClaw nails the always-on-assistant vibe but wasn’t built with a hacker’s toolbox in mind. Hermes is the one that behaves like a colleague: it has a home directory, a memory, a schedule, and it answers at 2 a.m. when you ping it from your phone.

3. My Daily Driver: Hermes

If you’ve read my n8n + Ollama post, you know I like my automation local, scriptable, and always-on. Hermes is basically that philosophy grown up into a full agent. Here’s what I actually use it for, daily:

• Recon and triage automation. Full shell, file tools, browser automation for those annoying JavaScript-only targets, sandboxed Python for the fiddly parsing jobs. Same tools I’d use by hand, just delegated.
• A real messaging gateway. The same agent — same memory, same skills — answers on Telegram, Discord, Signal, Matrix, email and more. My recon summaries follow me to my phone. No more “let me go check the terminal.”
• Cron jobs. Standing scheduled tasks: daily attack-surface checks, feed monitoring, the boring stuff. My n8n pipeline did some of this; now the agent does it natively, and it can act on what it finds instead of just pinging me.
• Model-agnostic. 20+ providers — Anthropic, OpenAI, OpenRouter, local models through Ollama, you name it. I swap the brain with one config line. When one API key dies mid-hunt, a credential pool rotates automatically. The harness is the investment; the model is a settings entry.
• Guardrails that fit the job. Approval prompts before destructive commands, and secret redaction on by default — tool output gets scanned for credential-looking strings before it ever hits the conversation. When your agent reads a .env file during recon, you want that.
• Persistent memory. It remembers who I am, my environment, what it learned last week. Crucially, it also knows what not to clutter memory with — facts go in memory, procedures go into skills. That separation keeps context lean instead of a swamp.

But the feature I’d genuinely pay for the whole harness for? Skills.

4. Skills: The Superpower

A skill is a markdown document — a procedure — that loads into the agent’s context when the task matches it, and not before. Not a system prompt you re-paste. Not a fine-tune. A file with a trigger condition.

Why this beats a prompt library:

1. Relevance-gated loading. I’ve got 1,100+ skills installed in my tree right now. Only the handful relevant to the current task actually load. The agent doesn’t pay rent on knowledge it isn’t using.
2. They accumulate. When Hermes cracks something gnarly — a weird privesc vector, a WAF quirk, a gateway workaround — it can save the procedure as a skill. Week one it’s a tool; month three it’s a colleague who knows my infrastructure.
3. They’re just files. Readable, diffable, shareable, publishable. Nothing hidden.

And the part everyone asks: how hard is it to add one?

# From the skills hub
hermes skills search "subdomain enumeration"
hermes skills install subfinder-enum

# From any public SKILL.md URL
hermes skills install https://github.com/someone/cool-skill/SKILL.md

# Or point it at a whole GitHub repo as a source
hermes skills tap add https://github.com/you/your-skill-repo

# Or just write it yourself
$EDITOR ~/.hermes/skills/my-skill/SKILL.md
hermes /reload-skills

That’s it. A directory, a markdown file with a description telling the agent when to load it, and (optionally) some reference files beside it. No SDK, no build step, no marketplace gatekeeper. Minutes, not days. The agent can even draft and maintain its own skills — there’s a background “curator” that tracks usage, archives stale ones, and keeps backups so nothing silently vanishes.

For security work this is huge, because our knowledge is procedural: how to attack a vuln class, what evidence a report must contain, which mistakes get a submission auto-closed. That stuff used to live in my head and my paste-bin. Now it’s versioned, loadable files.

Which brings me to the part I actually want to show you.

5. Case Study: Porting the YesWeHack Claude Kit into Hermes

YesWeHack (the bug bounty platform) published a Claude Code plugin — the YesWeHack Claude Kit — aimed at exactly the problem I opened with: LLM-assisted report writing is a minefield. Left unsupervised, the model inflates impact, invents details, pads with boilerplate, and validates leads you haven’t proven. Their fix is two layers:

• Always-on guardrails that keep the assistant honest from the first message of every session — no inventing facts about a target, no theoretical impact, no validating unproven leads.
• Three on-demand skills:
  • write — shapes a confirmed finding into the report structure YesWeHack expects, drafting only from facts you give it
  • triage — a strict pre-submission review that returns a verdict: READY / NEEDS FIXES / DO NOT SUBMIT
  • gotchas — per-vuln-class knowledge: minimum PoC proof, common false positives, and overclaim traps (14 classes, XSS through race conditions)

It’s a genuinely good design, it’s open source (GPL-3.0), and it’s built for Claude Code. Which I don’t live in. I live in Hermes.

Because both harnesses converge on “skills are markdown files,” the port was an afternoon, not a project:

1. Pull the three skills from the repo
2. Drop them into ~/.hermes/skills/ as ywh-write, ywh-triage, ywh-gotchas
3. Adapt the platform notes (my tree also carries my HackerOne conventions, so the triage skill now applies the same rigor to whichever platform I’m submitting to)

They load whenever I’m drafting a finding. No IDE required.

What actually changed in my workflow:

• The write skill killed my boilerplate. Structure is fixed — Description, Discovery, PoC, Exploitation, Impact — and the rules are blunt: impact only from what the PoC demonstrated, no “could lead to,” no OWASP essays, no References section just because the template has a slot.
• Triage before submission catches the expensive stuff. Scope failures. A PoC a triager can’t replay from scratch. A CVSS vector that doesn’t match the stated preconditions. It reads like the meanest triager on the platform — which is exactly who you want reading your draft before the real one does.
• gotchas is quietly the most valuable of the three. Knowing that a CORS report dies without Access-Control-Allow-Credentials: true plus a demonstrated credentialed read — that a WAF blocking your SQLi payload is not “SQLi confirmed” — is the difference between a bounty and an auto-close.

The bigger point isn’t “nice plugin, YesWeHack.” It’s that the same discipline is portable across harnesses in an afternoon, because skills are just files. If your guardrails live in a prompt you paste, you’ll forget to paste them on a Friday night. If they live in a skill that loads whenever the task is “write a bug bounty report,” they apply every time.

6. Bottom Line: Which Harness for Which Occasion?

After running this stack daily, here’s my decision table — same drill as my RF gear comparison:

None of this means Claude Code is bad — it’s the best at the thing it’s best at. The question isn’t “which harness wins.” It’s “which harness is this task?” Coding agents for repos. A harness with memory, a gateway, and skills for everything else — and for the all-day, cross-platform, remembering-everything work that security operations actually is, mine is Hermes.

Takeaways

1. The harness — tools, memory, skills, guardrails — now matters more than the underlying model. Stop arguing about models; start comparing harnesses.
2. Skills are the killer feature of a mature harness: relevance-gated, accumulative, and as easy to add as dropping a markdown file in a directory.
3. Guardrails for AI-assisted bug bounty writing exist and are portable. YesWeHack’s write/triage/gotchas triad maps cleanly onto any skills-first harness — mine included.
4. Match the harness to the occasion: coding agents for repos, an agent with memory and a gateway for operations.
5. If you use AI to write bug bounty reports, make the pre-submission triage step non-optional, whatever harness you run. Your acceptance rate will tell you why.

Links: Hermes Agent · YesWeHack Claude Kit · YesWeHack’s write-up · My earlier posts on n8n + Ollama automation and prompt injection attacks