Fix Security Vulnerabilities with Strix: Skill for Claude

Makes your agent fix the vulnerabilities a Strix pentest found, then re-run Strix to prove each fix works.

Installs: 17.3K; on skills.sh
Stars: 73.2K; on GitHub
Updated: Oct 2026; last repo commit

This skill works from a Strix report. It reads the findings from strix_runs/ or from the Strix cloud, orders them critical to low, reproduces each one with its proof of concept, fixes the root cause with a minimal diff, then re-scans to confirm. It ends with a short report per finding: severity, cause, fix location and verification result.

It needs the Strix tool, which in turn needs Docker and an LLM API key for the open-source CLI (or a Strix cloud login). Re-running scans uses that key and can cost money, so the examples cap each run with --max-budget 5. It ships in the Strix project's own repo.

Good for

Developers with a Strix scan report (CLI or app.strix.ai) and findings to remediate
Security-minded teams who want root-cause fixes, not payload blocking
Claude Code, Cursor or Codex users who already run Strix

Install fix-security-vulnerabilities-with-strix

Claude Code

Copy this prompt.

Install the fix-security-vulnerabilities-with-strix skill in Claude Code. Run this command:

npx skills add https://github.com/usestrix/strix --skill fix-security-vulnerabilities-with-strix

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.

Sections in SKILL.md

1. Triage
2. Fix
3. Verify by re-running Strix
4. Report

Key facts

Author: usestrix (SKILL.md metadata)
Repo: usestrix/strix
License: Apache-2.0 (as listed by the crawl)
Installs on skills.sh: 17,262 (Nov 2, 2026)
GitHub stars: 73,211 (repo, Nov 2, 2026)
Last commit: 2026-10-30
Files: 1 file: SKILL.md
License (SKILL.md): Apache-2.0
Needs: Strix CLI with Docker and an LLM API key, or a Strix cloud login

What it includes

Read findings from strix_runs/ files or pull them from the cloud with the strix CLI
Cloud commands include strix cloud vulns list and strix cloud scans get. Findings are worked critical, high, medium, low. Findings are not dismissed as false positives without re-testing the proof of concept.
Runs code · 1. Triage
Reproduce with the PoC, fix the root cause, keep the diff minimal
Examples: parameterise queries, add object-level authorization, allowlist for SSRF, context-aware output encoding for XSS, rotate leaked secrets and remove them from history.
Write · 2. Fix
Runs strix in quick diff mode against a base branch, or with the finding as focus
Resolves the repo's default branch for the diff base, then runs strix with --max-budget 5. Exit code 2 means findings remain; 0 means clean for what was analysed.
Runs code · 3a. Verify with the open-source CLI
Re-run the scan, poll until done, or trigger a PR review or single-finding retest
Uses curl against the Strix API for rerun and polling, and the retest endpoint for one vulnerability.
Runs code · 3b. Verify in the cloud
After verification, strix cloud vulns update <id> --status fixed
Changes the status of the finding in your Strix cloud account.
Write · Mark findings fixed
Per finding: severity, root cause, fix as file:line, verification result
Never includes live secrets; a leaked secret is reported as needing rotation.
4. Report

From the official docs

Permissions

Medium risk

The skill edits your code and runs Strix, which uses Docker and your LLM key and can cost money on each scan. Work on a branch and review the diff before you merge.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Re-scans spend LLM budget
Verification runs strix with your LLM key. The examples cap each run at --max-budget 5; check what that unit means in your Strix setup before raising it. github.com
It changes your code and your Strix account
The agent edits source files and, in cloud mode, can rerun scans and set findings to fixed. Work on a branch and review the diff. github.com
Strix needs Docker and a key
The open-source CLI needs Docker and an LLM key from a provider you choose. Read the Strix docs before pointing it at anything sensitive. github.com

Technical details

Talks to	app.strix.ai (cloud mode). your LLM provider, through Strix
Scopes	Strix cloud login (cloud mode)

Questions

What does this Strix skill do?

It takes the vulnerabilities a Strix pentest reported and has the agent fix them, then re-runs Strix to confirm each fix. It aims at root-cause fixes and a short report per finding.

How do I install it?

Use the install box above for this skill alone. The Strix README installs all nine Strix skills with npx skills add usestrix/strix. You also need the Strix tool itself, which the README installs separately.

Do I need Strix, Docker and an API key?

Yes for the open-source CLI. The README lists Docker and an LLM API key from a supported provider. For the cloud route you sign in with strix cloud login and need neither, according to the README.

Will it cost money?

Re-scans call an LLM through your key, so yes. The skill's examples cap each verification run with --max-budget 5, and it warns that a budget stop can leave coverage partial.

Does it work in Claude Code, Cursor and Codex?

The Strix README says Claude Code, Cursor, Codex or any SKILL.md-compatible agent can use its skills.

What is the difference from the other Strix skills?

The Strix repo has nine skills. This one fixes findings after a scan. The README describes the others as covering running pentests and CI scanning, and managed-pentesting-with-strix is the one SKILL.md points to for cloud login.

What does a clean re-scan mean?

Exit code 0 means clean for what was analysed. The skill says to check run.json shows a completed status and compare cost with the budget before trusting it, and to re-run the proof of concept when you can.

Is it safe to run?

It edits your code and runs the strix tool, which uses Docker and your LLM key. In cloud mode it can start reruns and mark findings fixed in your account. Work on a branch, review the diff, and never paste live secrets into a report.

Information

updated Nov 2, 2026

Repository: usestrix/strix
Folder: skills/fix-security-vulnerabilities-with-strix

usestrix/strix skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

fix-security-vulnerabilities-with-strix SKILL.md · github.com
usestrix/strix README · github.com
skills.sh listing · skills.sh
usestrix/strix · github.com