MCPInstall

strix

by akillnessSecurity

Install, configure, and operate Strix for AI-driven application security testing. Use when you need to run authorized vulnerability scans against local codebases, GitHub repositories, staging URLs, domains, or CI pipelines; configure Docker and LLM providers; choose quick, standard, or deep scan depth; or pass authenticated testing instructions to Strix. Triggers on: strix, ai pentest, vulnerability scan cli, appsec scan, bug bounty automation, strix ci, strix docker, strix scan mode, strix instruction file, headless security scan.

Installs
434
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/akillness/jeo-skills --skill strix
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads strix automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

strix - AI-Driven Application Security Testing

Keyword: strix · ai pentest · vulnerability scan cli · strix ci

Only use Strix against systems you own or are explicitly authorized to test.

Strix is an AI-driven application security CLI. It runs scans inside a Docker-backed sandbox, uses an LLM provider for reasoning, and can assess local directories, GitHub repositories, live URLs, domains, and multi-target combinations.

When to use this skill

  • Install Strix and verify Docker plus sandbox readiness
  • Configure STRIX_LLM, LLM_API_KEY, optional LLM_API_BASE, and related runtime settings
  • Run local white-box scans against a repository or directory
  • Run black-box or grey-box scans against staging or production-like URLs you are authorized to test
  • Pass credentials, scope, or rules of engagement with --instruction or --instruction-file
  • Choose the right scan depth: quick, standard, or deep
  • Run Strix headlessly in CI/CD and interpret exit codes
  • Understand Strix's internal security "skills" and how they differ from this repo's skills

Instructions

Step 1: Install and preflight

  1. Run bash scripts/install.sh
  2. Confirm strix --version succeeds
  3. Ensure Docker is installed and the daemon is running
  4. Let the installer pull the sandbox image on first setup unless you intentionally skip it
  5. For manual installation alternatives and direct commands, see references/commands.md

Step 2: Configure the model provider

Set the minimum required environment variables before running a scan:

export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"

Optional runtime variables:

  • LLM_API_BASE for OpenAI-compatible proxies or local endpoints
  • PERPLEXITY_API_KEY for web search during scans
  • STRIX_REASONING_EFFORT to tune model effort
  • STRIX_DISABLE_BROWSER=true when UI automation is unnecessary
  • STRIX_TELEMETRY=0 to disable telemetry defaults

Provider examples, config-file format, and optional environment variables are in references/providers-and-config.md.

Step 3: Pick the target and scan mode

Strix accepts these target types:

  • Local directory: ./app
  • GitHub repository URL: https://github.com/org/repo
  • Live web app URL: https://staging.example.com
  • Domain or IP
  • Multi-target scans via repeated --target or -t

Scan modes:

  • quick: PR checks, smoke tests, fast CI feedback
  • standard: routine security reviews
  • deep: default full assessment and longer bug-bounty-style exploration

Detailed mode and CI guidance lives in references/scan-modes-and-ci.md.

Step 4: Run the scan

Use bash scripts/run-scan.sh for a repeatable wrapper or call strix directly.

Common direct commands:

strix --target ./app
strix --target https://github.com/org/repo
strix --target https://staging.example.com --instruction-file ./instruction.md
strix -t https://github.com/org/repo -t https://staging.example.com

When authenticated or scoped testing matters, prefer --instruction-file over long inline prompts so credentials, exclusions, and rules of engagement stay explicit and reviewable.

Step 5: Review outputs and iterate

Strix stores results under strix_runs/<run-name>.

Exit codes to remember:

  • 0: completed without findings
  • 1: execution or environment error
  • 2: vulnerabilities found in headless mode

Use the run artifacts to confirm what Strix tested, what it found, and what needs revalidation after fixes.

Step 6: Automate in CI/CD

Use headless mode in automation:

strix -n --target ./ --scan-mode quick

CI runners need Docker access. For pull requests, default to quick; reserve standard or deep for scheduled or release-stage jobs. See references/scan-modes-and-ci.md and scripts/ci-scan.sh.

Step 7: Understand Strix internal skills

Strix has its own internal security knowledge packs under strix/skills/. They are not the same as this repo's agent skills.

  • Strix auto-selects up to 5 relevant internal skills per task
  • Categories include vulnerabilities, frameworks, technologies, protocols, and tooling
  • These internal skills enrich Strix agent behavior during the scan itself

See references/built-in-skills.md before assuming "skill" means the same thing across both ecosystems.

Examples

Example 1: Quick PR scan of a local repository

export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"
strix -n --target ./ --scan-mode quick

Example 2: Standard scan of a GitHub repository

strix --target https://github.com/acme/payments --scan-mode standard

Example 3: Grey-box scan of a staging URL

strix --target https://staging.example.com \
  --instruction-file ./instruction.md \
  --scan-mode deep

Example 4: Combined repo plus live target

strix -t https://github.com/acme/payments \
  -t https://staging.example.com \
  --instruction "Correlate source paths with exposed runtime issues"

Example 5: Browser-disabled API-focused scan

STRIX_DISABLE_BROWSER=true \
strix --target https://api.example.com --scan-mode standard

Example 6: Scripted run wrapper

bash scripts/run-scan.sh \
  --target ./app \
  --scan-mode quick \
  --non-interactive

Best practices

  1. Only test assets you own or are explicitly permitted to assess.
  2. Start with quick in CI and widen depth only when signal justifies the extra runtime.
  3. Keep secrets in environment variables, secret stores, or instruction files under your control instead of scattering them inline.
  4. Use both source and live targets together when you need better reproduction and remediation context.
  5. Expect the first run to be slower because Strix may pull its sandbox image.
  6. Treat strix_runs/ as evidence: archive useful runs, especially when findings are heading into triage or remediation.
  7. Be explicit about scope, exclusions, credentials, and rate limits so Strix does not waste time exploring irrelevant surfaces.
  8. Distinguish this repo's strix skill from Strix internal skills to avoid instruction confusion.

References

  • references/commands.md
  • references/providers-and-config.md
  • references/scan-modes-and-ci.md
  • references/built-in-skills.md
  • scripts/install.sh
  • scripts/run-scan.sh
  • scripts/ci-scan.sh
  • Strix GitHub Repository
  • Strix Documentation

FAQ

What does the strix skill do?

Install, configure, and operate Strix for AI-driven application security testing. Use when you need to run authorized vulnerability scans against local codebases, GitHub repositories, staging URLs, domains, or CI pipelines; configure Docker and LLM providers; choose quick, standard, or deep scan depth; or pass authenticated testing instructions to Strix. Triggers on: strix, ai pentest, vulnerability scan cli, appsec scan, bug bounty automation, strix ci, strix docker, strix scan mode, strix instruction file, headless security scan.

How do I install strix?

Run npx skills add https://github.com/akillness/jeo-skills --skill strix in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/strix/ (personal) or .claude/skills/strix/ (project).

Which AI agents can use strix?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is strix safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains strix?

It is published by akillness in akillness/jeo-skills. It has 434 recorded installs.

More from akillness/jeo-skills

View all →

rtk

akillness/jeo-skills

Install, initialize, verify, and troubleshoot RTK (Rust Token Killer) for AI coding agents. Use when you need to reduce shell-command token output, confirm that the correct rtk binary is installed, choose between Homebrew, install.sh, or Cargo installation, wire rtk init for Claude Code, Codex, Gemini CLI, Cursor, Copilot, Windsurf, Cline, or OpenCode, or use compact wrappers such as rtk git status, rtk read, rtk grep, rtk test, rtk lint, and rtk gain. Triggers on: rtk, rust token killer, token saver cli, rtk init, rtk gain, codex rtk, gemini rtk, opencode rtk, claude hook token reduction.

Backend & APIs672 installs

graphify

akillness/jeo-skills

Drive Graphify from its CLI to build, refresh, query, export, and serve a durable code/corpus knowledge graph. Use when the user wants .graphify/GRAPHREPORT.md, graph.json, graph.html, graphify update/summary/query/path/explain/tree, change-aware review context, git-hook or watch-based refresh, a stdio MCP graph server, or an install into jeo, jeopi, gjc, opencode, Claude, Codex, or Gemini. Also covers the honest structural fallback when native extraction is empty or misleading. Route simple locate/reference work to codebase-search, narrative knowledge-base work to llm-wiki, and project-memory handoff to opencontext. Triggers on: graphify, graphify update, graphify query, knowledge graph CLI, GRAPHREPORT.md, graph.json, codebase graph, graph refresh, graphify install, graphify serve, review context, affected flows.

Code Quality & Workflow662 installs

data-analysis

akillness/jeo-skills

Analyze datasets to extract insights, identify patterns, and generate reports.

598 installs

code-refactoring

akillness/jeo-skills

Turn a cleanup packet into one behavior-preserving refactor brief. Use when simplifying a messy function/component/service, freezing behavior before touching fragile legacy code, splitting a cleanup-heavy diff into reviewable slices, or planning a repeated migration / codemod without changing intended behavior. Route diagnosis to debugging, review judgment to code-review, validation-program design to testing-strategies, bottleneck-led tuning to performance-optimization, and pure symbol inventory to codebase-search.

Code Quality & Workflow546 installs

technical-writing

akillness/jeo-skills

Write internal technical documentation for engineers and operators: technical specs, architecture docs, ADRs, runbooks, migration plans, and developer-facing implementation guides. Use when the main job is capturing a technical decision, system boundary, operating procedure, or rollout path for builders and maintainers. Triggers on: tech spec, design doc, architecture doc, ADR, runbook, migration guide, implementation guide, rollout doc, operational guide, and internal technical writing. End-user onboarding guides, tutorials, FAQs, and help-center flows belong here too. Route API portals to api-documentation, release notes to changelog-maintenance, decks to presentation-builder, and GTM messaging to marketing-automation.

Docs & Writing544 installs

web-accessibility

akillness/jeo-skills

Routing-first skill for web accessibility remediation and verification. Use when the main job is classifying which accessibility surface is failing — semantics, keyboard/focus, labels/announcements, visual perception/reflow, media alternatives, or routed-app navigation feedback — and turning vague audit, WCAG, axe/Lighthouse, or "make this accessible" requests into one concrete remediation packet. Broad UI critique for hierarchy, polish, and launch readiness belongs here too. Route component API architecture and system governance to design-system, and responsive layout strategy to responsive-design.

Frontend & Design531 installs

Popular security skills

View category →

azure-compliance

microsoft/azure-skills

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.

OfficialSecurity567K installs

minimal-run-and-audit

lllllllama/rigorpilot-skills

Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.

Security477.4K installs

seo-audit

coreyhaines31/marketingskills

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.

Security238.7K installs

firebase-security-rules-auditor

firebase/agent-skills

Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.

OfficialSecurity139.1K installs

audit

pbakaus/impeccable

Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.

Security81.9K installs

competitors

coreyhaines31/marketingskills

When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.

Security79.3K installs