Plan and coordinate Strix security assessments across source code, running applications, APIs, and continuous integration pipelines. Combine findings into one prioritized remediation plan based on demonstrated impact, removing duplicates and documenting gaps in test coverage.
中文简介正在准备中。当前显示英语简介。
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.
安装前可以查看交给 AI 代理的指令内容。
Entry point for "make my application secure" requests, where the target is not yet a single URL or repo. The job here is to pick the right test per asset, run it, and produce one ranked plan — not to run everything at maximum depth.
Install, LLM setup, all CLI flags, and the managed-cloud path live in the penetration-testing-with-strix skill. Read it first if strix --version fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix).
Only test assets the user owns or is authorized to test. Confirm authorization before the first run, and prefer staging over production, because the agents send real exploit payloads and can change data.
Ask (or read from the repo) and write the answers down before scanning:
If there is no staging environment and production is off limits, say so early. A code-only review is still valuable, but it cannot prove exploitability against a live app.
| Asset | Skill to use |
|---|---|
| Repository or working tree | find-security-vulnerabilities-in-code |
| Live web app or staging site | web-app-penetration-testing |
| REST/GraphQL/gRPC API | api-security-testing |
| Assessment mapped to OWASP categories | owasp-top-10-testing |
| Every pull request, continuously | ci-security-scanning-with-strix |
| No Docker, no LLM key, or a report an auditor will accept | managed-pentesting-with-strix |
Those skills carry the flags, credential handling, and result-reading details. Do not duplicate their instructions here.
Sequence for a first assessment:
Run one asset at a time and read each report before starting the next. Findings from the code review make the live run sharper.
Findings arrive per run in strix_runs/<run>/. Merge them into a single list and rank by proven impact, not by scanner severity:
Deduplicate: the same root cause often surfaces in both the code review and the live pentest.
State plainly what was not tested — assets with no staging environment, categories a black-box run cannot reach (logging and alerting, supply-chain integrity, insecure design), and any run that hit its budget or turn cap before finishing. Check run.json status and cost against --max-budget for each run. An empty result set from a truncated scan is not a clean bill of health.
Then remediate with fix-security-vulnerabilities-with-strix, which re-runs Strix against each fix to prove the exploit no longer works.
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.
中文简介正在准备中。当前显示英语简介。
Set up Strix security checks in CI/CD to test pull request changes, report verified vulnerabilities, and gate merges. Covers both a CLI running on your own infrastructure and a managed service with pull request comments.
中文简介正在准备中。当前显示英语简介。
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
中文简介正在准备中。当前显示英语简介。
Turn Strix vulnerability findings into focused code fixes, prioritized by severity. Address root causes, rerun security scans and original exploit examples, and report the changes and verification results for each issue.
中文简介正在准备中。当前显示英语简介。
Run security tests for web apps, APIs, and source code on Strix Cloud without local Docker or an LLM key. Register targets, review findings in a team dashboard, export results, and configure recurring scans or PR reviews.
中文简介正在准备中。当前显示英语简介。
Assess an application against OWASP Top 10:2025 risk categories using Strix. Get findings backed by working exploit examples, organized by category, with clear explanations of what was tested and what remains unassessed.
中文简介正在准备中。当前显示英语简介。