Skip to content
Get packs

Fix Strix Security Findings

Patch validated Strix pentest findings at the root cause and re-scan to prove each fix works.

Source Download skill
Repository
usestrix/strix
Stars
73,304
Licence
Apache-2.0
Files
1 file

What it does

After a Strix security scan reports vulnerabilities, this skill tells the AI agent how to work through them: sort by severity, fix the underlying cause in the code rather than just blocking one attack string, and then run Strix again to confirm the exploit no longer works. It covers common issues such as injection, cross-site scripting, server-side request forgery and broken access control.

Great for

  • Developers who have received a Strix pentest report and want fixes applied quickly
  • Teams using the Strix cloud platform (app.strix.ai) who want to pull findings and remediate them from the command line
  • Security-minded engineers who want a repeatable verify-by-rescanning workflow

Skip it if

  • Projects with no Strix scan results: the skill assumes findings already exist in strix_runs/, vulnerabilities.json, or the cloud, so it adds little on its own
  • Changes that must go to production without review: the agent edits code and runs scans, so a human should review the diff and the re-scan results
  • Scans run against systems you do not own or have permission to test, since re-running Strix sends live requests to the target

Try asking

  • “Fix the critical and high findings from my latest Strix run in strix_runs/ and verify each one with a re-scan”
  • “Pull the findings for scan abc123 from app.strix.ai and patch the IDOR issues”
  • “Remediate the SQL injection in app/api/search.py and confirm the original PoC no longer reproduces”
Step-by-step guide: how to use Fix Strix Security FindingsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    fix-security-vulnerabilities-with-strix.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip fix-security-vulnerabilities-with-strix.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip fix-security-vulnerabilities-with-strix.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give verification runs enough budget to finish; check run.json for a completed status before trusting a clean result (exit code 0)
  • Re-run the original proof-of-concept directly when it is a simple request, as the fastest check
  • Keep any secrets found out of the report and rotate leaked credentials rather than just deleting them from code

What's inside

  • SKILL.md

Redistributed unmodified from usestrix/strix under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.