Skip to content
SkillCheatSheet Sign in

owasp-top-10-testing

An AI agent skill from usestrix/strix, scored 62 out of 100 by code.

62/ 100C

Code score by group

  • Spec20/20
  • Description13/20
  • Procedure0/15
  • Done criteria4/15
  • Resources10/10
  • Scripts5/8
  • Safety7/7
  • Upkeep3/5

It loses the most points in Procedure (15), the group that checks whether the steps are numbered, read the context first and say what to do when something fails.

What the author says it does

Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for…

This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.

Repository
usestrix/strix
Folder
skills/owasp-top-10-testing
License
Apache-2.0
GitHub stars
75,087
SKILL.md lines
65
Other files
0

Add owasp-top-10-testing to your agent

npx skills add usestrix/strix --skill owasp-top-10-testing

The command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.

More skills from usestrix/strix

  1. penetration-testing-with-strix

    Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond —…

    76B
  2. ci-security-scanning-with-strix

    Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it…

    70B
  3. fix-security-vulnerabilities-with-strix

    Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix…

    69C
  4. find-security-vulnerabilities-in-code

    Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization…

    65C
  5. web-app-penetration-testing

    Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, brok…

    65C
  6. managed-pentesting-with-strix

    Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Sa…

    64C
  7. api-security-testing

    Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-s…

    60C
  8. application-security-testing

    Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn th…

    59C

All skills in usestrix/strix

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.