Skip to content
SkillCheatSheet Sign in

find-security-vulnerabilities-in-code

An AI agent skill from usestrix/strix, scored 65 out of 100 by code.

65/ 100C

Code score by group

  • Spec20/20
  • Description12/20
  • Procedure4/15
  • Done criteria4/15
  • Resources10/10
  • Scripts5/8
  • Safety7/7
  • Upkeep3/5

It loses the most points in Procedure (11), the group that checks whether the steps are numbered, read the context first and say what to do when something fails.

What the author says it does

Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilitie…

This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.

Repository
usestrix/strix
Folder
skills/find-security-vulnerabilities-in-code
License
Apache-2.0
GitHub stars
75,087
SKILL.md lines
63
Other files
0

Add find-security-vulnerabilities-in-code to your agent

npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code

The command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.

More skills from usestrix/strix

  1. penetration-testing-with-strix

    Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond —…

    76B
  2. ci-security-scanning-with-strix

    Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it…

    70B
  3. fix-security-vulnerabilities-with-strix

    Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix…

    69C
  4. web-app-penetration-testing

    Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, brok…

    65C
  5. managed-pentesting-with-strix

    Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Sa…

    64C
  6. owasp-top-10-testing

    Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control…

    62C
  7. api-security-testing

    Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-s…

    60C
  8. application-security-testing

    Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn th…

    59C

All skills in usestrix/strix

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.