# penetration-testing-with-strix

> Claude/Codex skill by [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars · Updated 2026-10-15

Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.

Tags: agents, ai-hacking, ai-penetration-testing, ai-pentesting, ai-security, artificial-intelligence, bug-bounty, code-quality, ctf-tools, cybersecurity, cybersecurity-tools, ethical-hacking, hacking, llm-security, offensive-security, penetration-testing, pentesting-tools, red-teaming, security, security-automation

## Install

```sh
git clone https://github.com/usestrix/strix /tmp/strix && ln -s /tmp/strix/skills/penetration-testing-with-strix ~/.claude/skills/penetration-testing-with-strix
```

## From README

Run a Strix pentest Strix runs autonomous AI pentesting agents that dynamically exploit a target and only report findings validated with a working proof-of-concept. There are two ways to run it, built on the same engine and producing the same findings — pick per situation, and mix them freely: Open-source CLI (self-hosted) — runs on your machine in a Docker sandbox with your own LLM key. Free, fully local, BYO-LLM, air-gap capable. Docs: docs.strix.ai. Managed cloud — runs on Strix's infrastructure, driven from the same CLI (strix cloud ...) or the REST API at https://app.strix.ai/api/v1. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF/DOCX reports (Enterprise plan), and internal-network connectors. Docs: docs.app.strix.ai. Full workflow in the managed-pentesting-with-strix skill. Which one?

## Links

- HTML page: https://omgskills.com/skills/usestrix/strix/penetration-testing-with-strix/
- GitHub: https://github.com/usestrix/strix
- Author: [@usestrix](https://omgskills.com/library/usestrix/index.md)

## More from this repo

- [api-security-testing](https://omgskills.com/skills/usestrix/strix/api-security-testing/index.md) — Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 72k stars
- [application-security-testing](https://omgskills.com/skills/usestrix/strix/application-security-testing/index.md) — Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars
- [ci-security-scanning-with-strix](https://omgskills.com/skills/usestrix/strix/ci-security-scanning-with-strix/index.md) — Used to add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request...
   - [@usestrix](https://omgskills.com/library/usestrix/index.md) · 69k stars