web-app-penetration-testing

From README

Pentest a web application Black-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage. , LLM , all CLI flags, and the managed-cloud alternative are covered in the penetration-testing-with-strix skill — read it if the target is not a running web app, or if strix --version fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix). This skill is the web-app-specific workflow. Confirm authorization and scope Before running anything, establish: The target is the user's (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch. Which environment. Prefer staging over production; agents send real exploit payloads and will create/modify data.