Aexora Agent Base Preset

Corporate baseline for a capable agent on Cursor (and Hermes):

• ~2028 Cursor skills (Aexora workflows + vendor imports + Hermes library + ECC ecc-*)
• Always-on rules for Compact law, Estate builds, MCP, CI, communication, and external skills-repo ingest
• Persistent peer memory via corporate Honcho (https://api-honcho.aexoradao.com)
• Full MCP fleet preset: Honcho, Coolify, ERPNext, BugSink, Jenkins (+ optional Ghidra)
• Optional offensive security MCP hub (FuzzingLabs, 38 servers / 300+ tools via podman)
• Pinned Hermes Agent runtime bootstrap (optional)

Remote (source of truth): https://git.aexoradao.com/epistemophiliac/skills

Local clone (preferred): ~/aexora-skills-repo

Law instruments (policy): https://git.aexoradao.com/epistemophiliac/law
Local clone (preferred): ~/aexora-law-repo

---

AI agent guide (read this first)

Audience: Cursor/Hermes agents installing or operating this pack for a human.

Iron law: Install and merge only through the scripts in this repo. Never put secrets in git or mcp.json. Never overwrite honcho-agent-identity.mdc or MCP .env files from the pack.

1. Understand the system

Layer	Where	Job
Rules (always-on)	.cursor/rules/*.mdc → ~/.cursor/rules/	Policy + lifecycle without re-asking
Skills (on-demand)	.cursor/skills/<name>/SKILL.md	Playbooks; load by trigger, don’t dump all
Agents (optional)	.cursor/agents/	Named specialist prompts (ecc-agent-*)
MCP fleet	presets/aexora-mcp-fleet/ + presets/honcho-mcp/	Live deploy/CI/ERP/errors/memory tools
Security MCP hub	~/.cursor/mcp-servers/mcp-security-hub/ + hub-* in mcp.json	JIT offensive/recon tools (authorized only)
Memory	Honcho API + skill honcho-memory / mcp-honcho-awareness	Cross-session facts; fleet card, not schemas
Scripts	scripts/*.sh	Install, refresh, quality gate, vendor ingest, ECC merge
Vendor notes	vendor/IMPORT_*.md, vendor/AWESOME_*.txt	Import manifests / catalog queues (clones gitignored)

Source of truth: this Forgejo repo. ~/.cursor/skills/ is a working copy refreshed by apply-to-project.sh / update-skills-pack.sh.

Machine-local (never commit): Honcho JWT, MCP .env, hostname peer rule (honcho-agent-identity.mdc).

Skill prefixes (discoverability):

Prefix	Family	Approx count
(none / Aexora names)	Estate workflows, Hermes flat skills	~hundreds
ecc-*	Everything Claude Code adapted	~444
acs-*	Anthropic cybersecurity skills (mukul975)	817
sci-*	K-Dense scientific agent skills	158
ao-*	Addy Osmani engineering lifecycle	24
od-*	nexu-io open-design	162
aw-*	Awesome-catalog clones (wave imports)	150
ponytail-* / pwf-*	Ponytail / planning-with-files	12

Do not load all skills into context. Route by need (table below).

2. Coordinate work (how to operate)

1. Match the ask: Question → answer; Diagnose → recon; Build → implement; Policy → cite Compact (aexora-project-procedure / law repo / aexora-law-procedure-follow).
2. Estate / Aexora Build: follow estate-project-foundation (product-only clarify; Jenkins/Coolify/CI assumed). Coding standards: aexora-style-guide.
3. Lifecycle: Clarify → Recon → Design → Build → Harden (project-lifecycle). Engineering quality gates also map to ao-* (DEFINE→PLAN→BUILD→VERIFY→REVIEW→SHIP).
4. Skill routing: load the skill that matches the need. Prefer Aexora twins over raw ecc-* when both apply (ecc-pack-adaptation).
5. MCP: know the fleet from Honcho peer card / ~/.cursor/mcp-fleet-card.md; call GetMcpTools(server=X) only when invoking X (mcp-honcho-awareness). Enable hub-* security MCPs JIT — never attach all 38 every session.
6. New external skills/MCP repo from the user: follow external-skills-repo-ingest (always-on rule). Awesome catalogs: awesome-agent-skills-review.
7. Publish lessons: durable process → proactive-skill-capture → skill-quality-audit → maintain-skills-repo (commit + push here).

Skill routing (quick)

Need	Skill / script
Estate greenfield / ship	estate-project-foundation
Compact law / refusal gate	aexora-compact-authority, aexora-law-procedure-follow
How does this repo work	project-breakdown
Full audit / logic bugs	full-functionality-audit
Coolify compose / deploy	coolify-docker-compose, coolify-deploy
CI / VERSION / Jenkins bootstrap	production-ci-readiness, version-control-ci, jenkins-repo-bootstrap
Spec / plan / TDD / review / ship	ao-spec-driven-development, ao-planning-and-task-breakdown, ao-test-driven-development, ao-code-review-and-quality, ao-shipping-and-launch
Markdown plan files	pwf-planning-with-files
Authorized security research	security-research, estate-steam-security-research
Offensive security MCP hub	mcp-security-hub + ./scripts/install-mcp-security-hub.sh
Cyber skill playbooks	acs-* (Estate/Job Charter only)
Science / data / papers	sci-*
Design systems / UI craft	od-*
Ingest a new GitHub skills repo	external-skills-repo-ingest
Review VoltAgent awesome catalog	awesome-agent-skills-review
MCP install / health / awareness	mcp-standard, mcp-health-check, honcho-runtime-verify, mcp-honcho-awareness
Keep pack fresh	skills-pack-update, skills-pack-research
Publish a skill	skill-quality-audit → maintain-skills-repo
Bulk import vendor trees	./scripts/import-vendor-skills.sh
Merge ECC upstream	ecc-ingest + ./scripts/ecc-ingest.sh

3. Install correctly for the user

Pick one path. Ask only if the user did not state Cursor vs Hermes vs both.

A. New Cursor machine (recommended default)

git clone https://git.aexoradao.com/epistemophiliac/skills.git ~/aexora-skills-repo
cd ~/aexora-skills-repo
./scripts/apply-to-project.sh --personal
./scripts/activate-aexora-mcp-fleet.sh
./scripts/activate-honcho-mcp.sh
# Fill ~/.cursor/mcp-servers/mcp-*/.env from each .env.example (chmod 600)
# Quote values containing | or spaces
./presets/aexora-mcp-fleet/check-mcps.sh   # or ~/.cursor/mcp-servers/check-mcps.sh
./scripts/update-skills-pack.sh --install-timer
./scripts/mcp-honcho-recover.sh            # local fleet card + stamp

# Optional — law instruments (policy cites)
git clone https://git.aexoradao.com/epistemophiliac/law.git ~/aexora-law-repo

# Optional — FuzzingLabs security MCP hub (podman preferred; docker.sock often denied)
./scripts/install-mcp-security-hub.sh
python3 ./scripts/register-mcp-security-hub.py

Then: new Cursor agent session so MCP tools attach. Confirm Honcho peer card has MCP fleet ATTRIBUTE lines (mcp-honcho-awareness).

Defaults after Honcho activation (override only if user specifies):

Setting	Typical value
API	https://api-honcho.aexoradao.com
Human peer	epistemophiliac
Agent peer	cursor-<hostname> (machine-local)
Session	<agent>-with-<human>

B. Cursor skills/rules only (no MCP change)

cd ~/aexora-skills-repo   # or clone first
./scripts/apply-to-project.sh --personal          # all Cursor projects
# or
./scripts/apply-to-project.sh /path/to/project    # one project

rsync merges into the destination; it does not delete personal-only skills/rules unrelated to this pack.

Expect ~2k skill directories under ~/.cursor/skills/ after a full apply. Cursor discovers them on demand — do not paste inventories into prompts.

C. Full Hermes + skills + Honcho

git clone https://git.aexoradao.com/epistemophiliac/skills.git
cd skills
./scripts/bootstrap-hermes-agent.sh

Prompts for Honcho JWT → stores only in local MCP .env mode 600.

D. Refresh an existing machine (daily / on demand)

~/aexora-skills-repo/scripts/update-skills-pack.sh --check
~/aexora-skills-repo/scripts/update-skills-pack.sh --apply --mcp

Safety: allowlisted remote only, git pull --ff-only, refuses dirty clone unless user explicitly --force-dirty, never touches .env or honcho-agent-identity.mdc.

E. Security MCP hub only (after A)

# Prefer podman (script auto-selects podman when available)
~/aexora-skills-repo/scripts/install-mcp-security-hub.sh
# Default priority: gitleaks,semgrep,trivy,nuclei,nmap,radare2,yara,capa,hashcat,maigret
# Or: ./scripts/install-mcp-security-hub.sh gitleaks,nuclei,nmap

python3 ~/aexora-skills-repo/scripts/register-mcp-security-hub.py
# Registers hub-* entries in ~/.cursor/mcp.json (no secrets)
# New agent session required to attach

Runners: ~/.cursor/mcp-servers/mcp-security-hub/<name>-mcp/run.sh
Skill: mcp-security-hub. Authorized Estate/Job Charter targets only.

If docker.sock permission denied, use podman (default in the install script) or add the user to the docker group and re-login.

F. Ingest another external skills repo

# Clone under vendor (not committed — see .gitignore)
git clone --depth 1 https://github.com/<org>/<repo>.git \
  ~/aexora-skills-repo/vendor/<slug>
# Extend scripts/import-vendor-skills.sh SOURCES or rsync into .cursor/skills/
~/aexora-skills-repo/scripts/import-vendor-skills.sh   # known source ids
# Then quality-gate meta skills + maintain-skills-repo

Follow skill external-skills-repo-ingest. Catalog review: awesome-agent-skills-review (vendor/AWESOME_LINKS.txt).

4. Merge when needed

Situation	What to do
Consume pack updates on a laptop	update-skills-pack.sh --apply (ff-only; no git merge)
Dirty clone blocks pull	Stop. Commit/stash local pack edits, or ask user before --force-dirty
New/edited skill to ship	Quality audit → check-skill-quality.sh → sync into this repo → commit → git push (maintain-skills-repo)
Personal ~/.cursor/skills/X → pack	rsync -a that skill into .cursor/skills/X/ here; do not --delete the whole tree from personal
ECC upstream changed	./scripts/ecc-ingest.sh [--ecc-root PATH]; prefer Aexora twins; quarantine per ecc-pack-adaptation
Vendor bulk import	./scripts/import-vendor-skills.sh; update vendor/IMPORT_NOTES.md; Soft-defer full behavioral audit on mass imports
MCP preset changed in pack	update-skills-pack.sh --apply --mcp or re-run activate-aexora-mcp-fleet.sh (preserves .env)
Security hub images stale	./scripts/install-mcp-security-hub.sh (podman build)
Fleet awareness stale	./scripts/mcp-honcho-recover.sh then Honcho peer-card update (mcp-honcho-awareness)
Two divergent pack clones	Prefer remote main; ff-only pull. Do not invent merge commits in the updater path

Merge doctrine: consumers pull ff-only; publishers commit + push after quality gate. Do not force-push main. Do not commit secrets. Do not commit large vendor/<clone>/ trees (gitignored); commit imported .cursor/skills/ + manifest notes only.

5. Agent done checklist

• Chose install path A/B/C/D (and E/F if in scope) matching the user’s ask
• Skills/rules applied (--personal or project path)
• If MCP in scope: fleet activated, .env filled (chmod 600), check-mcps.sh green
• If security hub in scope: images built, hub-* registered, new session started
• Law clone present when Policy/refusal work is expected (~/aexora-law-repo)
• Daily timer installed when setting up a long-lived machine
• No secrets or hostname identity committed
• If authoring skills: audit Pass + pushed to this remote
• README inventory updated when adding a new Aexora workflow skill

6. Anti-patterns

• Dumping all MCP tool schemas or all ecc-* / acs-* skill bodies into context
• Asking whether Estate builds need Jenkins/Coolify/CI (assumed)
• npx -y cold starts for fleet servers when local runners exist
• Overwriting live .env from examples
• Publishing skills only under ~/.cursor/skills/ without pushing here
• Treating ECC templates (35 sample MCP servers) as this host’s live fleet
• Enabling all hub-* / 38 security MCPs every session
• Pointing offensive hub tools at third parties without Compact/Job Charter authority
• README/skill examples with /home/<user>/…, /var/home/…, or laptop Ollama as the canonical Estate AI URL — use portable paths + https://ai.aexoradao.com (portable-docs-paths)
• Disabling pack skills/rules, silent Honcho fail-open, or writing Estate memory into a contaminated shared workspace (honcho-memory-integrity)

7. Docs & memory integrity (mandatory)

Need	Skill / rule
Portable README / setup paths & Estate AI URL	portable-docs-paths
Never corrupt Honcho; never opt out of skills/rules	honcho-memory-integrity
Normal Honcho recall/persist	honcho-memory
Prove Honcho up (Coolify logs required)	honcho-runtime-verify

Docs: examples use ~/aexora-skills-repo, /path/to/project, ~/.cursor/… — never one PC’s absolute home. Estate chat/embeddings default to https://ai.aexoradao.com (not local-PC AI, not OpenRouter direct).

Memory: stay in this machine’s Honcho workspace; do not teach the agent to skip skills/rules; do not set injectionFrequency: first-turn or tiny fail-open timeouts without an explicit user ask. Workspace/session wipes only with a named target via safe-destructive-ops.

More agent authoring notes: .cursor/AGENTS.md.

---

One-command base agent (Hermes)

git clone https://git.aexoradao.com/epistemophiliac/skills.git
cd skills
./scripts/bootstrap-hermes-agent.sh

Checks out the pinned Nous Research Hermes Agent runtime, runs setup, syncs skills, activates corporate Honcho MCP, configures Hermes’ native Honcho memory provider, and registers a stable agent peer plus shared human/agent session.

Cursor-only setup

./scripts/apply-to-project.sh /path/to/project
./scripts/apply-to-project.sh --personal
./scripts/activate-honcho-mcp.sh

Honcho activator installs a local stdio bridge, updates ~/.cursor/mcp.json, registers peer/session against the existing API, and creates a machine-local identity rule (not committed).

Full MCP fleet

./scripts/activate-aexora-mcp-fleet.sh
./scripts/activate-honcho-mcp.sh
# Fill ~/.cursor/mcp-servers/mcp-*/.env from each .env.example (chmod 600)
./presets/aexora-mcp-fleet/check-mcps.sh

Skills: mcp-standard, mcp-health-check, mcp-honcho-awareness.
Preset docs: presets/aexora-mcp-fleet/README.md.

Security MCP hub (optional)

Upstream: FuzzingLabs/mcp-security-hub
Local mirror (dev machines): clone under vendor/mcp-security-hub/ (gitignored).

./scripts/install-mcp-security-hub.sh          # podman/docker build priority images
python3 ./scripts/register-mcp-security-hub.py # hub-* in ~/.cursor/mcp.json

See skill mcp-security-hub and vendor/IMPORT_NOTES.md.

Keep the pack fresh (daily)

./scripts/update-skills-pack.sh --check          # report only
./scripts/update-skills-pack.sh --apply --mcp    # pull + refresh skills + MCP runners
./scripts/update-skills-pack.sh --install-timer  # daily systemd --user timer ~09:00

Skills: skills-pack-update (files) + skills-pack-research (Honcho digest).
Publish with maintain-skills-repo; other machines consume via the updater.

---

Contents

Aexora workflows

aexora-project-procedure, aexora-compact-authority, aexora-law-procedure-follow, estate-project-foundation, aexora-style-guide, project-bootstrap, project-breakdown, full-repo-analysis, full-functionality-audit, production-ci-readiness, coolify-docker-compose, coolify-deploy, safe-destructive-ops, algorithm-design, economy-balance, development-team, cold-reader-docs, honcho-memory, professional-testing-review, latex-document-skill, industrial-behavioral-tests (+ industrial-tests-{core,craft,ui,persistence,ci}), root-cause-not-workaround, dynamic-completion-waits, maintain-source-sync, maintain-skills-repo, skills-pack-update, skills-pack-research, proactive-skill-capture, skill-quality-audit, external-skills-repo-ingest, awesome-agent-skills-review, mcp-security-hub, agent-skills-security-catalog, security-research, estate-steam-security-research, steam-client-recon, mcp-standard, mcp-health-check, honcho-runtime-verify, no-gpu-downgrade, mcp-honcho-awareness, cursor-mcp-stability, portable-docs-paths, honcho-memory-integrity, jenkins-repo-bootstrap, version-control-ci, nayana-clean-watch, steam-session-appid-bridge, and Cursor authoring/review workflows (create-skill, …).

Vendor skill families

See vendor/IMPORT_NOTES.md and vendor/IMPORT_MANIFEST.jsonl.

Family	Upstream	Prefix
Cybersecurity playbooks	mukul975/anthropic-cybersecurity-skills	acs-
Scientific / data	K-Dense-AI/scientific-agent-skills	sci-
Engineering lifecycle	addyosmani/agent-skills	ao-
Design	nexu-io/open-design	od-
Planning files	OthmanAdi/planning-with-files	pwf-
Ponytail	DietrichGebert/ponytail	ponytail-
Awesome waves	VoltAgent catalog clones	aw-

Bulk import: ./scripts/import-vendor-skills.sh.
Agent skills security research links: skill agent-skills-security-catalog.

ECC-adapted workflows

Full ECC catalog is vendored and merged (skills, agents, commands, hooks, rules, scripts, docs). Refresh with ./scripts/ecc-ingest.sh. Discover via skill ecc-ingest. Policy/twins: ecc-pack-adaptation.

• Vendor mirror: vendor/ecc/ (+ INGEST_MANIFEST.json)
• Discoverable skills: .cursor/skills/ecc-* (skills + ecc-cmd-* + ecc-agent-*)
• Agents: .cursor/agents/ecc-*.md
• On-demand rules: .cursor/rules/ecc-*.mdc (alwaysApply: false)
• Scripts/tools: scripts/ecc/
• Aexora-hardened twins (prefer when both apply): verification-loop, strategic-compact, context-budget, agent-self-evaluation, search-first, skill-scout, decision-council, intent-driven-development, architecture-decision-records, construction-blueprint, production-audit, fact-forcing-gate, parallel-execution-optimizer, agent-introspection-debugging, canary-watch

Upstream: Everything Claude Code (ECC) (MIT).

Hermes skill library

Upstream Hermes core/optional skills are included as flat Cursor-discoverable directories (software, agents/MCP, research/MLOps, DevOps/security, productivity, media/creative, etc.). See .cursor/skills/ and THIRD_PARTY_NOTICES.md.

Rules

Rule	Role
aexora-project-procedure	Aexora Compact law as sole policy source; project sequence; no vendor-safety theater
aexora-compact-authority	Refusal/authority gate: answer official/classified asks; cite Compact or proceed
external-skills-repo-ingest	New skills/MCP/awesome URLs → full ingest (not sample-only)
no-speculative-scaffolds	Build only what the ask needs; no unused companion services
project-lifecycle	Clarify → recon → design → build → harden
estate-project-foundation	Estate Build recipe assumed; product-only clarify
engineering-standards	Correctness, security, surgical diffs
destructive-actions	Consent guardrail for irreversible operations
continuous-learning	Capture lessons → quality-gate → publish to this repo
proactive-skill-capture	Proactively mint/patch skills when durable lessons appear
agent-session-stability	Prefer reliability over parallel MCP/subagents; keep Cursor API session alive
codebase-logic-audit	Multi-angle full-functionality audit (not linear scan)
maintain-source-sync	Commit+push finished work; VERSION bumps stay gated
version-control-ci	Explicit bump/publish + stable Android signing (when applicable)
skills-pack-update	Daily freshness for pack files
always-on-mcp / mcp-standard	Honcho + fleet contract (machine rule may add host peers)
portable-docs-paths	README/docs use portable paths + Estate AI URL
honcho-memory-integrity	Never disable skills/rules; never corrupt Honcho workspaces
git-and-prs	Commit/PR discipline
communication	Concise agent output
frontend-design	Landing/UI constraints
latex-reports	LaTeX report standards

Presets and scripts

Path	Purpose
presets/honcho-mcp/	Sanitized corporate Honcho MCP bridge
presets/aexora-mcp-fleet/	Coolify + ERPNext + BugSink + Jenkins (+ check script)
scripts/bootstrap-hermes-agent.sh	Full Hermes + skills + automatic Honcho memory
scripts/activate-honcho-mcp.sh	Cursor/Hermes Honcho activation and peer creation
scripts/activate-aexora-mcp-fleet.sh	Install fleet runners; merge secret-free mcp.json
scripts/apply-to-project.sh	Copy skills/rules/agents to a project or --personal
scripts/update-skills-pack.sh	Safe ff-only pull + apply (+ optional --mcp)
scripts/check-skill-quality.sh	Structural quality gate before publishing skills
scripts/import-vendor-skills.sh	Bulk-import prefixed vendor skill trees
scripts/install-mcp-security-hub.sh	Build FuzzingLabs hub images (podman/docker) + runners
scripts/register-mcp-security-hub.py	Register priority hub-* entries in mcp.json
scripts/ecc-ingest.sh	Mirror + generate full ECC catalog into the pack
scripts/mcp-honcho-recover.sh	Rebuild local MCP fleet awareness card + stamp
scripts/inventory-skills-pack.sh	Inventory helper for research/digest

Updating (publish to this repo)

1. Author under ~/.cursor/skills/ or this repo’s .cursor/skills/.
2. Run skill skill-quality-audit until Pass.
3. Run ./scripts/check-skill-quality.sh .cursor/skills/<name>.
4. Follow skill maintain-skills-repo: sync, update README if needed, commit, push.
5. Re-run ./scripts/apply-to-project.sh --personal (or rely on the daily updater) on other machines.

Do not commit secrets or machine-local identity rules (hostname Honcho peers). Do not commit vendor/<clone>/ source trees — only imported skills + vendor/IMPORT_*.md / manifests.

• axsql-target-clearance — final SQLi clearance with WAF auto (no sqlmap dual-run)