Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wedabro/bro-skills --skill managed-pentesting-with-strixgit clone --depth 1 https://github.com/wedabro/bro-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wedabro/bro-skills/managed-pentesting-with-strix)<a href="https://agentmods.dev/skills/wedabro/bro-skills/managed-pentesting-with-strix"><img src="https://agentmods.dev/badge/skills/wedabro/bro-skills/managed-pentesting-with-strix/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wedabro/bro-skills/managed-pentesting-with-strix"><img src="https://agentmods.dev/badge/skills/wedabro/bro-skills/managed-pentesting-with-strix.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00139 | $0.02200 |
| Opus 5 | $0.00069 | $0.01100 |
| Sonnet 5 | $0.00028 | $0.00440 |
| Haiku 4.5 | $0.00014 | $0.00220 |
Grade A, and why
managed-pentesting-with-strix scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{ Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sS "$BASE/domains" "${auth[@]}" -H "Content-Type: application/json" \ This is a copy
95% identical to managed-pentesting-with-strix — 295 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Strix Cloud API (managed, no local infra)
Use this when you want Strix's autonomous pentesting without running Docker or an LLM yourself — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the penetration-testing-with-strix skill instead — both share the same engine and SARIF output, so you can mix them.
Full reference: docs.app.strix.ai · OpenAPI: https://docs.app.strix.ai/openapi.json
Setup
-
Base URL:
https://app.strix.ai/api/v1 -
Auth: every request sends
Authorization: Bearer <token>. Tokens are org-scoped. -
Get a token: the user creates one in the dashboard at Settings → API Access (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store.
-
Scopes (least-privilege): assign only what the integration needs and rotate regularly:
Scope Grants scans:read/scans:writelist/read/report scans · create/rerun/cancel scans vulnerabilities:read/:writeread findings · update status & notes assets:read/:writeread domains/repos · register/update them schedules:read/:writeread schedules · create/trigger recurring scans pr_reviews:writetrigger PR security reviews webhooks:read/:writemanage webhook subscriptions tokens:writecreate/revoke API tokens
export STRIX_API_TOKEN="<token>"
BASE=https://app.strix.ai/api/v1
auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")
All examples use jq to parse JSON. Handle HTTP errors: 401 bad/expired token, 402 out of credits, 403 scope/plan-tier limit, 422 validation error.
1. Register the target as an asset
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 153 lines · 139 tokens per session scan A 0bd5894a17ac
managed-pentesting-with-strix is a skill published in the GitHub repository wedabro/bro-skills (2 stars, last pushed 14d ago), licensed MIT. It adds 139 tokens to every session and 2,200 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). It is 95% identical to managed-pentesting-with-strix, differing in 295 lines, and is treated as a copy.
Other skills, from other repositories
科研可视化工具
A research-visualisation workflow for examining data and producing publication-ready charts for scientific papers.
math-modeling
A workflow for mathematical modelling, where real-world questions are represented with mathematics and solved with code or analysis.
math-modeling
A workflow for mathematical modelling, where real-world questions are represented with mathematics and solved with code or analysis.
LaTeX工具
A tool for creating, compiling, and checking mathematical modelling papers written in LaTeX, a document system often used for technical writing.
DOCX工具
A tool for creating, editing, checking, and converting Microsoft Word DOCX files. It also handles LaTeX research papers, mathematical formulas, tables, tracked changes, and comments.
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and…