Strix is an open-source penetration-testing tool that uses autonomous AI agents to inspect applications, exploit vulnerabilities, and validate findings with working proofs of concept. Developers and security teams use it for application security testing, bug-bounty research, remediation guidance, reporting, and automated checks in development pipelines.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add usestrix/strix --skill fix-security-vulnerabilities-with-strixgit clone --depth 1 https://github.com/usestrix/strixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/usestrix/strix/fix-security-vulnerabilities-with-strix)<a href="https://agentmods.dev/skills/usestrix/strix/fix-security-vulnerabilities-with-strix"><img src="https://agentmods.dev/badge/skills/usestrix/strix/fix-security-vulnerabilities-with-strix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/usestrix/strix/fix-security-vulnerabilities-with-strix"><img src="https://agentmods.dev/badge/skills/usestrix/strix/fix-security-vulnerabilities-with-strix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket warn
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.01468 |
| Opus 5.5 | $0.00050 | $0.00587 |
| Sonnet 5.5 | $0.00025 | $0.00294 |
| Haiku 4.5 | $0.00012 | $0.00147 |
Grade A, and why
fix-security-vulnerabilities-with-strix scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
new_id=$(curl -sS "$BASE/scans/$scan_id/rerun" "${auth[@]}" -X POST | jq -r .scan_id) Copies of this mod
1 near-identical copy found in the catalogue:
- fix-security-vulnerabilities-with-strix — 92% identical, 6 lines differ
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Fix Strix findings and verify
Turn validated Strix findings into minimal, correct fixes — and prove they work by re-scanning.
1. Triage
Get the findings from wherever the scan ran:
- OSS CLI — artifacts in
strix_runs/<run-name>/:vulnerabilities/*.md— one finding per file: description, severity, PoC steps or script, affected code locations, remediation guidance.vulnerabilities.json— the same findings as JSON (ids, severity, CWE/CVE,code_locationswithfix_before/fix_aftersuggestions when available).
- Cloud (app.strix.ai) — pull findings with the CLI:
strix cloud vulns list --scan-id <scan-id> --json(orstrix cloud scans get <scan-id> --json | jq '.vulnerabilities', orstrix cloud vulns list --severity criticalorg-wide). Each finding carriesseverity, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_codeand, for code findings,code_file/code_diff/code_before/code_after. After a fix is verified, mark it withstrix cloud vulns update <id> --status fixed. See the managed-pentesting-with-strix skill forstrix cloud loginand scopes.
Order work by severity: critical → high → medium → low. Every Strix finding was validated with a working proof-of-concept, so do not dismiss findings as false positives without re-testing the PoC yourself.
2. Fix
For each finding:
- Reproduce it with the PoC from the finding file when feasible.
- Fix the root cause, not the specific payload (parameterize every query instead of blocking one string, and enforce authorization in the handler instead of hiding the endpoint).
- Prefer the framework's built-in defense (ORM parameterization, template auto-escaping, CSRF middleware, centralized authz) over ad-hoc sanitization.
- Keep the diff minimal and apply the repo's existing patterns. Finding files often include
fix_before/fix_aftersnippets — use them as a starting point, not verbatim.
Common finding classes and expected fixes: injection → parameterization/escaping at the sink; IDOR/broken access control → object-level authorization checks; SSRF → allowlist + block internal ranges; XSS → context-aware output encoding + CSP; secrets exposure → rotate the secret AND remove it from code/history; auth issues → fix the server-side check (never client-side).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed bb1b351fd60c
- 1mo ago First seen · 78 lines · 124 tokens per session scan A 6be75ecea9dd
fix-security-vulnerabilities-with-strix is a skill published in the GitHub repository usestrix/strix (70,805 stars, last pushed today), licensed Apache-2.0. It adds 124 tokens to every session and 1,468 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-foundations-3.2.3
Ensure that RDS instances are not publicly accessible.
cis-aws-foundations-2.14
Ensure IAM policies that allow full ":" administrative privileges are not attached.
cis-aws-foundations-2.15
Ensure a support role has been created to manage incidents with AWS Support.
cis-aws-foundations-3.1.4
Ensure that S3 is configured with 'Block Public Access' enabled.
cis-aws-foundations-3.2.1
Ensure that encryption-at-rest is enabled for RDS instances.
cis-aws-foundations-3.2.2
Ensure the Auto Minor Version Upgrade feature is enabled for RDS instances.