Skip to content
SkillCheatSheet Sign in

web-app-penetration-testing

An AI agent skill from usestrix/strix, scored 65 out of 100 by code.

65/ 100C

Code score by group

  • Spec20/20
  • Description13/20
  • Procedure3/15
  • Done criteria4/15
  • Resources10/10
  • Scripts5/8
  • Safety7/7
  • Upkeep3/5

It loses the most points in Procedure (12), the group that checks whether the steps are numbered, read the context first and say what to do when something fails.

What the author says it does

Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.

This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.

Repository
usestrix/strix
Folder
skills/web-app-penetration-testing
License
Apache-2.0
GitHub stars
75,087
SKILL.md lines
55
Other files
0

Add web-app-penetration-testing to your agent

npx skills add usestrix/strix --skill web-app-penetration-testing

The command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.

More skills from usestrix/strix

  1. penetration-testing-with-strix

    Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond —…

    76B
  2. ci-security-scanning-with-strix

    Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it…

    70B
  3. fix-security-vulnerabilities-with-strix

    Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix…

    69C
  4. find-security-vulnerabilities-in-code

    Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization…

    65C
  5. managed-pentesting-with-strix

    Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Sa…

    64C
  6. owasp-top-10-testing

    Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control…

    62C
  7. api-security-testing

    Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-s…

    60C
  8. application-security-testing

    Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn th…

    59C

All skills in usestrix/strix

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.