Skip to content
Get packs

Guide · Agent skill

How to use the Fix Strix Security Findings agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the fix-security-vulnerabilities-with-strix skill, a set of instructions that teaches an AI coding agent how to work through the vulnerabilities a Strix pentest has reported. It is for developers and security-minded engineers who already have Strix scan results and want them fixed and checked. By the end you will know how to install the skill, ask for remediation in plain language, and review what the agent does.

Fix Strix Security Findingsusestrix/strix · Apache-2.0

Quick start

  1. 1Get Strix findings. Run a Strix scan with the CLI, or log in with strix cloud login to fetch findings from app.strix.ai.
  2. 2Install the skill. Unzip the downloaded ZIP so SKILL.md sits in ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills.
  3. 3Ask for remediation. Name your findings source, such as strix_runs/, vulnerabilities.json or a cloud scan ID, and ask the agent to fix them.
  4. 4Review each fix. Check that the agent fixed the root cause in the code, following the repo's existing patterns, with a minimal diff.
  5. 5Re-run Strix. Ask the agent to re-scan the changed files or re-run the original PoC to confirm the exploit no longer works.
  6. 6Run tests. Run the project's own test suite to make sure the fix did not break existing behavior.
  7. 7Read the report. Review the summary of severity, root cause, file and line, and verification result before merging.

What is an agent skill and what does this one do?

An agent skill is a folder with a SKILL.md file that gives an AI agent extra instructions for a specific task. When your request matches the skill's description, the agent reads these instructions and follows them.

This skill covers the step after a Strix scan. It tells the agent to sort findings by severity (critical, high, medium, low), fix the root cause in the code rather than blocking one attack string, and then re-run Strix to confirm the exploit no longer works. The source says it handles injection, XSS, SSRF, broken access control, IDOR and other validated findings.

  • Triage: read findings from a local strix_runs/ folder or from the Strix cloud platform (app.strix.ai).
  • Fix: apply minimal changes that follow the repo's existing patterns and the framework's built-in defenses.
  • Verify: re-scan the changed area or re-run the original proof-of-concept, and run the project's test suite.
  • Report: summarize severity, root cause, fix location and verification result for each finding.

What do you need before you start?

The skill assumes Strix findings already exist. It adds little without them. The source lists these requirements:

  • The Strix CLI (open-source, usestrix/strix) with an LLM configured for scans.
  • A Git repository with an origin remote, which is used to determine the diff base for re-scans.
  • A Strix cloud account and strix cloud login, only if you fetch findings from app.strix.ai.
  • jq and curl, for the cloud commands shown in the instructions.

How do you install the skill?

Download the ZIP for this skill from this page. The skill's file list contains SKILL.md. Unzip it so that the folder containing SKILL.md sits in one of the following locations:

  • Personal skills: ~/.claude/skills/ (available across your projects).
  • Project skills: the .claude/skills/ folder inside a specific project.
  • Claude apps: upload the skill under Settings → Capabilities → Skills.

How do you trigger the skill with natural requests?

You do not need a special command. The skill is used when your request is about remediating findings from a Strix scan. The description names these triggers: a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan. Name the source so the agent knows where to look.

  • "Fix the findings in strix_runs/ from last night's scan, critical first."
  • "Patch the security issues in vulnerabilities.json and re-scan to confirm they're closed."
  • "Pull the findings for scan <scan-id> from Strix cloud and remediate the high-severity ones."
  • "Fix the IDOR reported in the Strix report and show me the diff."

How does the cloud workflow work?

If your scan ran on app.strix.ai, the skill pulls findings with the Strix CLI. The source gives these examples. Each finding includes fields such as severity, cwe, endpoint, method and poc_script_code. After a fix is verified, the skill marks the finding as fixed.

strix cloud vulns list --scan-id <scan-id> --json strix cloud scans get <scan-id> --json | jq '.vulnerabilities' strix cloud vulns list --severity critical strix cloud vulns update <id> --status fixed

How does the agent verify each fix?

Verification is the core of the workflow. The skill re-runs Strix scoped to the changed files, or re-runs the original finding as the focus of a new scan. Exit code 2 means findings remain, and 0 means clean for what was analyzed. The skill also says to check run.json for a completed status before trusting a 0, because a budget stop can leave partial coverage.

  • Re-test changed files with --scope-mode diff and --diff-base, or focus on one finding with --instruction.
  • Re-run the PoC manually when it is a simple request or script, which is the fastest signal.
  • Run the project's own test suite to confirm the fix does not break behavior.
  • In the cloud, rerun the scan or trigger a fresh PR review on the fix branch.
strix -n -t ./ --scan-mode quick --scope-mode diff --diff-base "$DIFF_BASE" --max-budget 5 strix -n -t ./ --instruction "Verify the SQL injection in app/api/search.py is fixed. Original PoC: <poc>" --max-budget 5

What should you check before trusting the results?

Review the agent's work before merging. The skill itself says to have a human review the diff and the re-scan results, and that re-running Strix sends live requests to the target. Only scan systems you own or have permission to test. Never include live secrets in the report; if a secret leaked, the skill says rotation is required.

  • Confirm the diff base resolved correctly. The skill refuses to guess and asks for the base branch if none is found.
  • Check run.json status and llm_usage.cost against your --max-budget.
  • Do not treat a finding as a false positive without re-testing its PoC.

What people use it for

  • Fixing a SQL injection in a search endpoint reported in a local strix_runs/ folder, then re-running Strix on that file.
  • Working through a cloud scan's critical and high findings by pulling them with the Strix CLI and marking each as fixed after verification.
  • Replacing an IDOR with a server-side object-level authorization check and confirming the original PoC fails.
  • Tightening an SSRF finding with an allowlist and blocking internal address ranges, then re-testing the request path.
  • Reviewing a fix branch by triggering a fresh PR review on app.strix.ai.

Frequently asked questions

Is the fix-security-vulnerabilities-with-strix skill free?

The skill is published under the Apache-2.0 licence, as listed on this page. The source does not state pricing for the Strix CLI or the app.strix.ai cloud platform, so check those separately before you rely on them.

What do I need to install the Strix agent skill?

Download the ZIP from this page and unzip it so SKILL.md is in ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps. You also need the Strix CLI with an LLM configured, a Git repository with an origin remote, and, for cloud findings, a Strix cloud account with strix cloud login.

Do I need app.strix.ai to use this skill?

No. The skill works with local artifacts in strix_runs/, including vulnerabilities/*.md and vulnerabilities.json. The cloud workflow is only needed if you fetch findings from app.strix.ai.

Why does the skill need a Git diff base?

Re-scans scoped with --scope-mode diff need a base branch to compare against. The skill looks for origin/HEAD, then origin/main, origin/master and origin/develop, and asks you for the base branch if none resolves rather than guessing.

Why does the agent say a scan with exit code 0 may not be complete?

Exit code 0 means clean for what was analyzed. If a run ended on a budget warning, it can record completed with partial coverage, so the skill tells the agent to check run.json and compare llm_usage.cost with --max-budget.

How is this different from just asking an AI to fix security bugs?

This skill is built around a verify loop. It uses validated Strix findings with working proofs-of-concept, prefers framework defenses over ad-hoc sanitization, and re-runs Strix to confirm each exploit is closed.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits developers who have a Strix pentest report and want fixes applied and checked quickly, and teams that manage findings on app.strix.ai from the command line. It is not useful without existing scan results, and it should not push changes to production without a human reviewing the diff and re-scan output. Teams that want a general code-review or dependency-scanning tool, rather than Strix-specific remediation, should look elsewhere.

Download the skill