Skip to content
Get packs

API security testing with Strix

Pentest REST, GraphQL, or gRPC APIs for authorization and OWASP API Top 10 flaws, with replayable proof requests

Source Download skill
Repository
usestrix/strix
Stars
73,304
Licence
Apache-2.0
Files
1 file

What it does

Once installed, the agent can run Strix, an autonomous security testing tool, against an API you own. Strix reads an OpenAPI, Postman, or GraphQL description to list the endpoints, then tries to exploit the API-specific weaknesses in the OWASP API Top 10, such as one user reading another tenant's data or a regular user calling admin routes. Each confirmed finding comes with a working request the agent can replay to verify it.

Great for

  • Backend developers who want an authorization audit of a staging API before release
  • Security engineers scoping an API pentest and needing a repeatable workflow with two test accounts
  • Teams adding API security checks to pull-request CI

Skip it if

  • Testing APIs you do not own or have no written permission to test, since it sends real attack traffic and the skill itself warns against this
  • Production systems with payments or destructive admin endpoints unless those are explicitly excluded, because the agents may send harmful requests
  • Users without Docker and an LLM API key or Strix cloud account, because the workflow depends on the Strix tool being installed and configured

Try asking

  • “Test our staging REST API at api.staging.example.com for broken object-level authorization across two tenants, using the attached OpenAPI file”
  • “Run a security scan on this GraphQL endpoint and check whether introspection, batching, and per-field authorization are safe”
  • “Audit /admin routes for function-level authorization problems using a low-privilege and a high-privilege token”
Step-by-step guide: how to use API security testing with StrixInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    api-security-testing.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip api-security-testing.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip api-security-testing.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Use only test accounts and a staging environment, and list out-of-scope routes such as billing or notifications so the agents skip them
  • Keep tokens out of shell history and committed files by using --instruction-file, and manually replay each proof request before reporting a finding
  • Provide the backend source code alongside the API URL so agents can check ownership logic directly rather than guessing from responses

What's inside

  • SKILL.md

Redistributed unmodified from usestrix/strix under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.