Find Security Vulnerabilities in Code
Scan a codebase with Strix and report only security issues proven by a working exploit
- Repository
- usestrix/strix
- Stars
- 73,304
- Licence
- Apache-2.0
- Files
- 1 file
What it does
Once installed, the agent can run Strix, an open-source AI security tool, against your source code or repository. Strix reads the code to map routes, risky operations and authorization checks, then tries to actually exploit suspected bugs in a sandbox. The result is a short list of confirmed issues, each with a proof-of-concept and file and line references, instead of a long list of unverified warnings from a pattern-matching scanner.
Great for
- Developers who want a deeper security review of a service, monorepo subtree or branch than a linter gives
- Teams preparing for an audit who need authorization, injection and business-logic bugs checked
- Anyone who wants proof-of-concept evidence rather than theoretical static-analysis alerts
Skip it if
- Quick checks on a large repo or tight budget, since runs can be slow and costly and may be capped before the whole tree is reviewed (use --scope-mode diff or scope to a subtree)
- Finding known-CVE dependencies or committed secrets, which dependency and secret scanners cover more completely
- Running against code you do not own or have permission to test, because the agents may modify the mounted folder and attempt real exploitation
Try asking
- “Run a security scan on my current repo and summarise the proven vulnerabilities”
- “Audit the authorization layer in src/auth and the admin routes for IDOR or tenant isolation bugs”
- “Review only the changes on this branch against origin/main for security issues”
- “Scan the checkout service with my local app running on port 3000 to confirm exploitability”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
find-security-vulnerabilities-in-code.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip find-security-vulnerabilities-in-code.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip find-security-vulnerabilities-in-code.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Point Strix at a clean checkout and, if possible, a running instance of the app, so findings are confirmed rather than only suspected
- Tell the agent about your tenancy model, trust boundaries and attacker-controlled inputs in the --instruction flag, since it cannot reliably infer them
- Treat a clean exit as 'nothing proven exploitable in what was analysed', not as proof the codebase is secure; check run.json for status and budget use
What's inside
- SKILL.md
Redistributed unmodified from usestrix/strix under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.