Skip to content
SkillCheatSheet Sign in

penetration-testing-with-strix

An AI agent skill from usestrix/strix, scored 76 out of 100 by code.

76/ 100B

Code score by group

  • Spec20/20
  • Description14/20
  • Procedure13/15
  • Done criteria4/15
  • Resources10/10
  • Scripts5/8
  • Safety7/7
  • Upkeep3/5

It loses the most points in Done criteria (11), the group that checks whether there is a checklist and a step that verifies the work.

What the author says it does

Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.

This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.

Repository
usestrix/strix
Folder
skills/penetration-testing-with-strix
License
Apache-2.0
GitHub stars
75,087
SKILL.md lines
163
Other files
0

Add penetration-testing-with-strix to your agent

npx skills add usestrix/strix --skill penetration-testing-with-strix

The command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.

Labelled for

More skills from usestrix/strix

  1. ci-security-scanning-with-strix

    Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it…

    70B
  2. fix-security-vulnerabilities-with-strix

    Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix…

    69C
  3. find-security-vulnerabilities-in-code

    Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization…

    65C
  4. web-app-penetration-testing

    Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, brok…

    65C
  5. managed-pentesting-with-strix

    Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Sa…

    64C
  6. owasp-top-10-testing

    Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control…

    62C
  7. api-security-testing

    Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-s…

    60C
  8. application-security-testing

    Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn th…

    59C

All skills in usestrix/strix

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.