managed-pentesting-with-strix Skill: Run Strix Cloud Pentests From Your Agent

Lets your agent run managed Strix pentests on app.strix.ai from the command line, without local Docker or an LLM key.

Installs: 16.8K; on skills.sh
Stars: 73.2K; on GitHub
Updated: Oct 2026; last repo commit

The agent uses the strix cloud CLI (or the REST API) to sign in, register a domain or repository, start a scan, wait for it, read the findings and export SARIF. It can also upload local source for review, trigger PR security reviews, and set up schedules and webhooks.

The scan runs on Strix's servers and most scans use paid credits. The skill can buy credits through the Stripe Link wallet, with your approval in the Link app. Only scan assets you own or may test.

Good for

Security engineers who want agent-driven scans tracked in a team dashboard
Teams in sandboxed agents or CI without Docker
Developers who want to scan a local project without running a model themselves

Install managed-pentesting-with-strix

Claude Code

Copy this prompt.

Install the managed-pentesting-with-strix skill in Claude Code. Run this command:

curl -sSL https://strix.ai/install | bash

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Run both: the CLI gives the agent the strix command, and the skills CLI adds the skill. The README installs all nine Strix skills this way; add --skill managed-pentesting-with-strix to take only this one. Then run strix cloud login.

From the project README. Source.

What's in the skill

When it loads

Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Safely review and upload local source, register assets, launch and poll scans, triage vulnerabilities, export SARIF, download compliance reports, start PR reviews, buy credits, and set up schedules or webhooks. Use for managed, continuous, scheduled, team-tracked, or sandboxed-agent security testing.

Sections in SKILL.md

Setup: sign in
0. Credits & top-ups
Workspaces and account setup
Handoffs a person must finish
Organization knowledge
1. Register the target as an asset
2. Launch a scan
Scan a local workspace in the cloud
3. Wait for completion
4. Read findings
5. Export & report
6. PR reviews
7. Continuous testing (schedules & webhooks)
Safety

Key facts

Author: usestrix
License: Apache-2.0
Installs on skills.sh: 16,843 (Nov 2, 2026)
GitHub stars: 73,211 (Nov 2, 2026), whole repo
Files: 1 file including SKILL.md
Last commit: Oct 30, 2026 (repo)
Needs: The strix CLI and a Strix account (device sign-in in the browser)
Token storage: Personal API token in ~/.strix/platform-auth.json
Cost: Non-Enterprise scans use credits; a default-tier source-only code review starts at 60 credits
Plan limits: Report downloads need Enterprise, schedules need Pro

What it includes

strix cloud login with chosen scopes
Device sign-in approved in your browser. Scope presets are Recommended, Full access, Minimal or custom; Recommended excludes token management.
Runs code · Sign in
strix cloud credits, billing topup, subscribe and auto-topup
Checks the balance and buys credits through the Stripe Link wallet; you approve each payment in the Link app. Without a terminal the command needs --yes, and SKILL.md says to show the spend and get your approval before adding it. It can also print a hosted checkout link for you to pay in the browser, and an admin token can switch on automatic top-ups with a monthly cap.
Runs code · Credits and top-ups
Add domains and repositories to scan
Scans run against registered assets. External domains need DNS, file or meta-tag verification.
Write · Register assets
strix cloud scans start with a type and targets
live_test, code_review, internal_infra or compliance_pentest, with focus, context, credentials and notification flags.
Write · Start a scan
Review, approve by SHA-256, upload, scan
A dry run lists the files; a second command uploads only if the archive digest matches what you approved. Hidden, secret-like files and archives are excluded by default.
Write · Local source scan
scans get, vulns list, vulns update
Reads severity, CWE, endpoint and proof-of-concept fields, and updates status such as fixed or ignored.
Write · Read findings and triage
SARIF export and PDF or DOCX reports
SARIF is for code scanning; report downloads need the Enterprise plan.
Write · Export and reports
Continuous testing
PR reviews start from the CLI, schedules need Pro, and webhooks push scan events to Slack or your own pipeline.
Write · PR reviews, schedules, webhooks
Account management
Create workspaces and service tokens, and edit the organization knowledge base and policies.
Delete · Workspaces, tokens, knowledge base

From the official docs

Permissions

High risk

What it can do

Read your data
Create and change things
Delete things
Read-only modeHow to turn it on

Watch out for

It can buy credits and set up automatic top-ups
strix cloud billing topup pays through the Stripe Link wallet, and each payment is approved in the Link app. Without a terminal it needs --yes, which SKILL.md says to add only after you approve the spend. An admin token can also enable auto-topup with a monthly cap, so keep billing:write off unless you want that. github.com
It can upload your source code
Source scans send an archive to Strix. Review the dry-run file list first and keep secret-like files out. github.com
It stores an API token on disk
The login saves a token in ~/.strix/platform-auth.json. Choose the Minimal scope profile when you can, and run strix cloud logout when done. github.com
It can change and delete workspace data
Tokens, workspaces, knowledge entries, policies and vulnerability status can be edited or deleted with the right scopes. Leave tokens:write off unless you need it. github.com

Technical details

Turning on read-only	Log in with a read-only scope set such as scans:read, vulnerabilities:read and assets:read.
Talks to	app.strix.ai. strix.ai installer. Stripe Link wallet for top-ups
Sign-in and keys	Personal API token stored in ~/.strix/platform-auth.json; STRIX_API_TOKEN overrides it per command.
Scopes	scans:read/write uploads:write billing:read/write (admin) tokens:write knowledge:write assets:write

Questions

What does this skill do?

It teaches your agent the strix cloud CLI. The agent can register targets, launch pentests on the Strix platform, wait for results, triage findings, export SARIF and start PR reviews.

How do I install it?

Use the install box above. You need the strix CLI too, which the README installs with a curl command, and a Strix account created through the browser sign-in.

Is it free?

No. Non-Enterprise scans use credits, and the skill gives 60 credits as the start for a default-tier source-only code review. Reports need Enterprise and schedules need Pro.

Can it spend my money?

Yes, on your Strix account. Scans use credits that you pay for: strix cloud billing topup pays through the Stripe Link wallet, and SKILL.md says you approve each payment in the Link app. Without a terminal the command stops unless it includes --yes, and the skill says to show the estimated spend and get your approval first. billing subscribe instead prints a hosted checkout link that you pay in the browser. With an admin token and billing:write, the agent can also turn on automatic top-ups (the example sets 20 credits with a 200-credit monthly cap), which charge without a per-purchase prompt. Leave billing:write off if you do not want that. SKILL.md describes no free test mode; Enterprise scans are plan-included and do not debit the wallet.

Does it upload my code?

Only if you scan local source. It runs a dry run that lists the files and a SHA-256, and uploads only after you approve that digest. Hidden files, secret-like names and dependency folders are excluded unless you add flags.

Is it safe?

It signs in with your Strix account, stores a token on disk, can upload source and can spend credits. Use a narrow scope profile, and scan only assets you own or are allowed to test.

How is it different from the open-source Strix skills?

This one runs scans on Strix's servers. The skill points to penetration-testing-with-strix for fully local, free, air-gapped or BYO-LLM runs.

Information

updated Nov 2, 2026

Repository: usestrix/strix
Folder: skills/managed-pentesting-with-strix

usestrix/strix skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 2

usestrix/strix README · github.com
managed-pentesting-with-strix SKILL.md · github.com