fix-security-vulnerabilities-with-strix
Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.
Install
With your agent
Install OMGSkills skill "usestrix/strix:fix-security-vulnerabilities-with-strix" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/fix-security-vulnerabilities-with-strix ~/.claude/skills/fix-security-vulnerabilities-with-strixFrom README
Fix Strix findings and verify Turn validated Strix findings into minimal, correct fixes — and prove they work by re-scanning. Triage Get the findings from wherever the scan ran: OSS CLI — artifacts in strixruns/ /: vulnerabilities/.md — one finding per file: description, severity, PoC steps or script, affected code locations, remediation guidance. vulnerabilities.json — the same findings as JSON (ids, severity, CWE/CVE, codelocations with fixbefore/fixafter suggestions when available). Cloud (app.strix.ai) — pull findings with the CLI: strix cloud vulns list --scan-id --json (or strix cloud scans get --json | jq '.vulnerabilities', or strix cloud vulns list --severity critical org-wide). Each finding carries severity, cwe, endpoint, method, impact, technicalanalysis, pocdescription, pocscriptcode and, for code findings, codefile/codediff/codebefore/codeafter. After a fix is verified, mark it with strix cloud vulns update --status fixed.
More from this repo
api-security-testing
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
ci-security-scanning-with-strix
Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...
penetration-testing-with-strix
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that...