owasp-top-10-testing
Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.
Install
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/owasp-top-10-testing ~/.claude/skills/owasp-top-10-testingFrom README
Test against the OWASP Top 10 The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP Top 10 testing" means exercising each category against the real application and reporting what's actually exploitable. Strix's agents do the exploitation; this skill covers running it category-by-category and reporting coverage honestly. Use the current edition: OWASP Top 10:2025 (8th installment, superseding 2021). Ask the user before targeting an older edition — some compliance checklists still reference 2021, and a report labelled with the wrong edition is misleading. Key differences from 2021: SSRF is folded into A01, A03 Software Supply Chain Failures expands the old "Vulnerable and Outdated Components", and A10 Mishandling of Exceptional Conditions is new; A02 Security Misconfiguration moved 5→2. , LLM , and the managed-cloud alternative: penetration-testing-with-strix.
More from this repo
api-security-testing
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
application-security-testing
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source...
ci-security-scanning-with-strix
Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...