Skip to content
Get packs

Strix Penetration Testing

Lets your agent run autonomous security pentests on apps, APIs, and repos and report proven vulnerabilities.

Source Download skill
Repository
usestrix/strix
Stars
73,304
Licence
Apache-2.0
Files
1 file

What it does

This skill teaches an AI agent how to run Strix, an open-source autonomous penetration-testing tool. Instead of only flagging possible security issues, Strix tries to exploit a target (a web app, API, repo, URL, domain or IP) and reports only findings it has confirmed with a working proof-of-concept, in formats such as Markdown, JSON, CSV or SARIF. The agent can run it locally via the self-hosted CLI in Docker, or via the managed app.strix.ai cloud, and helps choose between them.

Great for

  • Developers who want a security scan of their own staging app, API or repository before release
  • Security-minded teams adding a headless vulnerability gate to CI pipelines
  • Teams that want shared dashboards, scheduled scans or PR reviews through the managed cloud

Skip it if

  • Testing systems you do not own or have written permission to test, since it actively exploits targets and can cause damage or break services
  • Anyone expecting a guaranteed complete audit: the skill itself warns a clean result is not proof of full coverage, especially when budget or turn limits are hit
  • Users without Docker or an LLM API key who do not want cloud use, since the self-hosted option requires both

Try asking

  • “Pentest my staging app at https://staging.example.com with a $20 budget limit”
  • “Run a Strix security scan on this local repo and report findings as SARIF”
  • “Scan my OpenAPI spec and its live API for IDOR and auth bypass issues”
  • “Gate my pull requests in CI with Strix and fail the build on high-severity findings”
Step-by-step guide: how to use Strix Penetration TestingInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    penetration-testing-with-strix.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip penetration-testing-with-strix.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip penetration-testing-with-strix.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Always confirm you have authorization to test the target, and start with scan-mode quick or standard and a --max-budget cap
  • Never commit API keys; ask the user for credentials and pass them via environment variables or --instruction-file, and use a clean checkout since local paths are mounted writable
  • Use --fail-on severity thresholds in CI and treat exit code 0 as no findings in analyzed scope, not full coverage

What's inside

  • SKILL.md

Redistributed unmodified from usestrix/strix under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.