# fix-security-vulnerabilities-with-strix

> Claude/Codex skill by [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars · Updated 2026-10-15

Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix\_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.

Tags: agents, ai-hacking, ai-penetration-testing, ai-pentesting, ai-security, artificial-intelligence, bug-bounty, code-quality, ctf-tools, cybersecurity, cybersecurity-tools, ethical-hacking, hacking, llm-security, offensive-security, penetration-testing, pentesting-tools, red-teaming, security, security-automation

## Install

```sh
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/fix-security-vulnerabilities-with-strix ~/.claude/skills/fix-security-vulnerabilities-with-strix
```

## From README

Fix Strix findings and verify Turn validated Strix findings into minimal, correct fixes — and prove they work by re-scanning. Triage Get the findings from wherever the scan ran: OSS CLI — artifacts in strixruns/ /: vulnerabilities/.md — one finding per file: description, severity, PoC steps or script, affected code locations, remediation guidance. vulnerabilities.json — the same findings as JSON (ids, severity, CWE/CVE, codelocations with fixbefore/fixafter suggestions when available). Cloud (app.strix.ai) — pull findings with the CLI: strix cloud vulns list --scan-id --json (or strix cloud scans get --json | jq '.vulnerabilities', or strix cloud vulns list --severity critical org-wide). Each finding carries severity, cwe, endpoint, method, impact, technicalanalysis, pocdescription, pocscriptcode and, for code findings, codefile/codediff/codebefore/codeafter. After a fix is verified, mark it with strix cloud vulns update --status fixed.

## Links

- HTML page: https://omgskills.com/skills/usestrix/strix/fix-security-vulnerabilities-with-strix/
- GitHub: https://github.com/usestrix/strix
- Author: [@usestrix](https://omgskills.com/library/usestrix/index.md)

## More from this repo

- [api-security-testing](https://omgskills.com/skills/usestrix/strix/api-security-testing/index.md) — Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 72k stars
- [application-security-testing](https://omgskills.com/skills/usestrix/strix/application-security-testing/index.md) — Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars
- [ci-security-scanning-with-strix](https://omgskills.com/skills/usestrix/strix/ci-security-scanning-with-strix/index.md) — Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars