Skip to content
Get packs

CI/CD Security Scanning with Strix

Add a diff-scoped AI pentest to every pull request in GitHub Actions, GitLab CI or any pipeline

Source Download skill
Repository
usestrix/strix
Stars
73,304
Licence
Apache-2.0
Files
1 file

What it does

Once installed, the agent can set up Strix, an open-source AI security testing tool, inside your CI pipeline so each pull request is scanned for vulnerabilities before it merges. It can write a GitHub Actions workflow or pipeline step that runs a scan limited to the changed files, fails the build when validated vulnerabilities are found, and optionally uploads results to GitHub code scanning. It can also point you to the managed app.strix.ai platform, which needs no runner setup.

Great for

  • Development teams that want a pre-merge security gate on pull requests
  • Engineers maintaining GitHub Actions or GitLab CI pipelines who want a security step added
  • Teams that prefer a hosted option with no CI maintenance (managed platform path)

Skip it if

  • Projects without Docker on their CI runners or without an LLM API key, since the self-hosted path needs both (the managed path is the alternative)
  • Teams expecting a passing scan to mean the code is secure: the skill notes a pass only covers what was analyzed, and a budget-limited run can finish early
  • Repositories where scan results or code must not leave your environment if you choose the managed platform, since that option sends data to an external service

Try asking

  • “Add a Strix security scan to our GitHub Actions workflow that runs on every pull request”
  • “Set up diff-scoped Strix scanning in our GitLab merge request pipeline”
  • “Help me decide between the managed Strix app and a self-hosted CI scan for our team”
  • “Upload Strix SARIF findings to GitHub code scanning”
Step-by-step guide: how to use CI/CD Security Scanning with StrixInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    ci-security-scanning-with-strix.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip ci-security-scanning-with-strix.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip ci-security-scanning-with-strix.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Keep the 'fail unless the scan completed' step and give the budget headroom, so a budget-limited run does not silently pass.
  • Use --fail-on high if you want the build to fail only on high or critical findings, while still reviewing lower ones.
  • Store STRIX_LLM and LLM_API_KEY as repository secrets and never paste the key into the workflow file.

What's inside

  • SKILL.md

Redistributed unmodified from usestrix/strix under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.