SkillHub

Skills usestrix strix

Strix Bundle of 8 skills

Use it when:
You want to find and fix security vulnerabilities in your own app, API or code with autonomous AI pentesting.
It does:
Runs Strix agents that exploit a target and validate each finding with a PoC, then helps you patch and re-test.
You get:
Exploit-proven findings, root-cause fixes, CI gating and SARIF, from one engine run locally or in the cloud.
Works with:
The open-source CLI (Docker plus your LLM key) or the managed app.strix.ai cloud.
Needs:
A target you own or are authorized to test.

TL;DR

Strix's skills share one engine: autonomous AI agents that dynamically exploit a target and report only findings proven with a working proof-of-concept. penetration-testing-with-strix is the hub, covering install and the choice between the self-hosted open-source CLI (Docker plus your own LLM key, air-gap capable) and the managed app.strix.ai cloud. Four skills target a specific surface: web-app-penetration-testing for a running site, api-security-testing for REST/GraphQL/gRPC, owasp-top-10-testing for a category-mapped assessment, and find-security-vulnerabilities-in-code for a white-box code review. application-security-testing routes a whole product's assets to the right one and merges the results into a ranked plan. Once a scan reports, fix-security-vulnerabilities-with-strix patches root causes and re-scans to prove each exploit is closed, and ci-security-scanning-with-strix gates every pull request. All share the same SARIF output, so findings line up across local and cloud runs.

Summarizes the repo at 0601550.

Any agent, with the skills CLI

npx skills add usestrix/strix

Source on GitHubAll skills from usestrix/strix

Total Downloads
20,000 of penetration-testing-with-strix, its most installed skill, on skills.sh, Nov 9, 2026
Repo stars
74,490 usestrix/strix
First seen
Aug 7, 2026 on skills.sh, its first skill

Its skills, in the order they're used

The ones marked “Only in the bundle” need the rest of it. The others also work alone.

  1. penetration-testing-with-strix

    20K total downloads

    Pentests a web app, API, codebase, URL or domain with Strix's autonomous agents, returning findings validated by working proof-of-concept exploits.

  2. application-security-testing

    Only in the bundle 15.6K total downloads

    Maps a product's assets to the right Strix test, runs them in sequence, and consolidates the results into one impact-ranked remediation plan.

    Routes each asset to the bundle's other Strix skills and sequences the runs; on its own it gives the mapping and a ranked plan but defers the actual testing and setup to them.

  3. find-security-vulnerabilities-in-code

    15.9K total downloads

    Runs a white-box Strix security review of a codebase, reasoning about data flow and authorization, then exploiting findings in a sandbox with a PoC.

  4. web-app-penetration-testing

    16.1K total downloads

    Pentests a live web app end to end with Strix, exploiting auth, access-control, injection and business-logic flaws and proving each with a PoC.

  5. api-security-testing

    16K total downloads

    Security-tests a REST, GraphQL or gRPC API with Strix, enumerating endpoints from a schema and exploiting the OWASP API Top 10 with proof-of-concept requests.

  6. owasp-top-10-testing

    16K total downloads

    Tests an application against the current OWASP Top 10 with Strix, exploiting each category it can and reporting coverage honestly.

  7. fix-security-vulnerabilities-with-strix

    18.8K total downloads

    Triages Strix findings, patches the root cause, and re-runs Strix to prove each exploit is closed.

  8. ci-security-scanning-with-strix

    18.4K total downloads

    Adds Strix security scanning to CI/CD so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before merge.