# application-security-testing

> Claude/Codex skill by [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars · Updated 2026-10-15

Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.

Tags: agents, ai-hacking, ai-penetration-testing, ai-pentesting, ai-security, artificial-intelligence, bug-bounty, code-quality, ctf-tools, cybersecurity, cybersecurity-tools, ethical-hacking, hacking, llm-security, offensive-security, penetration-testing, pentesting-tools, red-teaming, security, security-automation

## Install

```sh
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/application-security-testing ~/.claude/skills/application-security-testing
```

## From README

Application security testing Entry point for "make my application secure" requests, where the target is not yet a single URL or repo. The job here is to pick the right test per asset, run it, and produce one ranked plan — not to run everything at maximum depth. , LLM , all CLI flags, and the managed-cloud path live in the penetration-testing-with-strix skill. Read it first if strix --version fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix). Only test assets the user owns or is authorized to test. Confirm authorization before the first run, and prefer staging over production, because the agents send real exploit payloads and can change data. Map the assets Ask (or read from the repo) and write the answers down before scanning: Source — one repo, a monorepo, several services? Which languages/frameworks?

## Links

- HTML page: https://omgskills.com/skills/usestrix/strix/application-security-testing/
- GitHub: https://github.com/usestrix/strix
- Author: [@usestrix](https://omgskills.com/library/usestrix/index.md)

## More from this repo

- [api-security-testing](https://omgskills.com/skills/usestrix/strix/api-security-testing/index.md) — Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 72k stars
- [ci-security-scanning-with-strix](https://omgskills.com/skills/usestrix/strix/ci-security-scanning-with-strix/index.md) — Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars
- [find-security-vulnerabilities-in-code](https://omgskills.com/skills/usestrix/strix/find-security-vulnerabilities-in-code/index.md) — Used to find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars