Skills DirectoryCurated open-source Skills from GitHub
English

find-security-vulnerabilities-in-codecommit 42baa7cSKILL.md · Security Audit

Strix: Find Security Vulnerabilities in Code

White-box security review with Strix: reads source for data flow and authorization, then attempts exploitation in a sandbox with a PoC.

Requires the Strix CLI plus Docker and an LLM key, or a Strix cloud login; runs incur model costs.

npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code
Permissions
  • read-repo
  • write-files
  • shell
  • network
Compatible with
Claude Code, Codex, Cursor
GitHub
73.1k
Source
Official · Strix
Status
Scan passed
License
Apache-2.0
Category
Security Audit
Repository
github.com/usestrix/strix/skills/find-security-vulnerabilities-in-code

Core rule

Check each PoC demonstrates impact before reporting; exit 0 means nothing exploitable was proven, not that the code is clean.

Execution Phases

  1. Phase 01Scope the review

    Point at the risky subtree or the branch diff, and state the tenancy model, trust boundaries and attacker-controlled inputs.

  2. Phase 02Run Strix

    Run strix on a local tree or GitHub repo with --max-budget; add a running instance as a target to confirm exploitability.

  3. Phase 03Read the results

    Start with penetration_test_report.md, then open each finding under vulnerabilities/ and check the PoC, file and line.

  4. Phase 04Fix and re-verify

    Hand off to the companion fix skill for the root cause, re-run Strix to confirm the exploit fails, and keep SCA and secret scanning in place.

Permissions (summarised from SKILL.md)

CapabilityNeededDetails
File writesLimitedA local path is mounted writable into the sandbox and agents can modify it, so run on a clean checkout; results go to strix_runs/.
Command executionLimitedRuns the Strix CLI, which executes its agents and exploit attempts in a Docker sandbox.
Network outboundLimitedCalls the configured LLM provider and the named repo or app targets; cloud mode uses the Strix managed platform.

SKILL.md frontmatter (YAML)

SKILL.md frontmatter (YAML)commit 42baa7c
---
name: find-security-vulnerabilities-in-code
description: Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
license: Apache-2.0
metadata:
  author: usestrix
  homepage: https://docs.strix.ai
---

Related skills

A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.
Markdown version GitHub