AppSec Testing Skill (Strix) for Claude Code: Ranked Plan

Makes Claude plan a whole-product security review with Strix, choosing a test per asset and ranking proven issues first.

Installs: 14.1K; on skills.sh
Stars: 73.2K; on GitHub
Updated: Oct 2026; last repo commit

This is the entry point for "make my application secure" requests. Claude first maps your assets: source code, a running web app, APIs, logins and limits. It then picks a Strix-based test for each asset, runs them one at a time, and merges the results into one plan ranked by what was proven reachable, not by scanner severity.

It needs the Strix CLI and its sibling skills. SKILL.md says the Strix agents send real exploit payloads and can change data, so only test assets you own or are authorized to test, and prefer staging over production.

Good for

Teams preparing for a launch or a customer security questionnaire
Developers who do not know which kind of security test they need
Security leads who want one ranked remediation plan

Install application-security-testing

Claude Code

Copy this prompt.

Install the application-security-testing skill in Claude Code. Run this command:

curl -sSL https://strix.ai/install | bash

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Docker, An LLM API key.

This skill only plans the work. It calls the Strix CLI and eight sibling skills from the same repo, so install the CLI and the skill set together. Without a local setup, SKILL.md points to the managed route (strix cloud login) in the managed-pentesting-with-strix skill.

From the project README. Source.

What's in the skill

When it loads

Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.

Sections in SKILL.md

1. Map the assets
2. Pick the right test per asset
3. Consolidate into one plan
4. Be honest about coverage

Key facts

Author: usestrix
Repository: usestrix/strix
Installs on skills.sh: 14,074 as of 2026-11-02
GitHub stars: 73,211 for the whole usestrix/strix repo
License: Apache-2.0 (SKILL.md frontmatter)
Last repo commit: 2026-10-30
What is inside: 1 file: SKILL.md. It bundles no scripts. It hands work to eight sibling skills in the same repo.
skills.sh audits: Gen Agent Trust Hub: pass; Socket: warn; Snyk: pass
Needs: The Strix CLI, Docker and an LLM API key for local runs, or Strix cloud sign-in
Sibling skills: penetration-testing-with-strix, managed-pentesting-with-strix, find-security-vulnerabilities-in-code, web-app-penetration-testing, api-security-testing, owasp-top-10-testing, ci-security-scanning-with-strix, fix-security-vulnerabilities-with-strix

What it includes

Source, running environments, APIs, auth and constraints
Claude asks about or reads from the repo: languages, staging or production, API type and schemas, two test accounts in different tenants, and limits such as budget and out-of-scope paths.
1. Map the assets
Routes each asset to a sibling skill
Repo goes to find-security-vulnerabilities-in-code, a live site to web-app-penetration-testing, an API to api-security-testing, OWASP mapping to owasp-top-10-testing, pull requests to ci-security-scanning-with-strix, and no Docker or LLM key to managed-pentesting-with-strix.
Runs code · 2. Pick the right test
Review the code, pentest staging, then add CI scanning
SKILL.md says code review is the cheapest run, then a staging pentest with credentials and the repo as a second target, then CI scanning. Run one asset at a time and read each report first.
Runs code · First-assessment order
Merge strix_runs findings and rank by proven impact
Ranking order: validated unauthenticated exploits, validated cross-tenant or privilege issues, validated authenticated issues, then unproven observations flagged as such. Duplicates are merged.
Read · 3. Consolidate into one plan
List what was not tested
Name assets with no staging, categories a black-box run cannot reach, and runs that hit their budget or turn cap. An empty result from a truncated scan is not a clean bill of health.
4. State coverage honestly
Re-runs Strix against each fix
Remediation goes to fix-security-vulnerabilities-with-strix, which re-runs Strix to prove the exploit no longer works.
Runs code · Hand-off to fixing

From the official docs

Permissions

High risk

The skill triggers active security testing that sends real exploit payloads and can change data on the target. Only test systems you own, start with staging, and set a budget limit.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Strix sends real exploit payloads
SKILL.md says the agents exploit and prove issues and can change data. Test staging with accounts you created, and get written authorization before testing anything you do not own. github.com
The installer is a curl-to-bash script
The README installs the CLI with curl -sSL https://strix.ai/install | bash and the first run pulls a Docker sandbox image. Read the script first if you need to. github.com
Runs cost money through your LLM key
Local runs use your LLM provider key. SKILL.md tells Claude to compare each run’s cost with --max-budget, so set one. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	No read-only mode. Pick a code-only review if you cannot test a live system.
Talks to	The target you point Strix at. Your LLM provider (local runs). The Strix managed platform if you use strix cloud
Sign-in and keys	Local runs read LLM_API_KEY from your environment. strix cloud login stores a credential per install, per the README.
Data retention	Run output stays in strix_runs/ on your machine.
Scopes	The Strix CLI scans the repo or URL you give it Local runs need an LLM API key; the managed route needs a Strix cloud sign-in Results are saved under strix_runs/<run-name>

Questions

What does the application-security-testing skill do?

It plans an AppSec review. Claude lists your assets, picks the right Strix test for each one, runs them in order and produces one remediation plan ranked by proven exploitability.

How do I install it?

Use the install box above. The install box has two steps: the Strix CLI installer, and npx skills add usestrix/strix. That second command installs all nine Strix skills, not only this one, and the README says so. This skill hands the actual testing to the other eight.

Does it need an API key?

For local runs the README lists an LLM API key from a supported provider and Docker. Without those, SKILL.md points to the managed route, which starts with strix cloud login.

Will it attack my production site?

SKILL.md tells Claude to confirm authorization before the first run, and to prefer staging, because the agents send real exploit payloads and can change data. You are responsible for scope.

How is it different from the other Strix skills?

This one chooses and orders the tests and writes the consolidated plan. SKILL.md says the sibling skills carry the flags, credentials handling and result-reading details, and it does not repeat them.

Is it safe?

The skill file bundles no scripts, but the testing it triggers is active. Strix agents send real exploit payloads at the target and can change data, per SKILL.md. Use a staging copy you own, with test accounts, and set a budget limit.

Information

updated Nov 2, 2026

Repository: usestrix/strix
Folder: skills/application-security-testing

usestrix/strix skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 2

usestrix/strix README · github.com
application-security-testing SKILL.md · github.com