penetration-testing-with-strix: a Claude Code skill by Strix

Official

For developers who want automated pentests that prove each finding with a working exploit. Skip it if you can't confirm you are authorized to attack the target.

High-risk warning At least one scanner rated it high risk, so we keep it out of the top ten. Read its code before you install it.

Before you install: It installs the CLI by piping a script from strix.ai straight into bash, and the scanning agents get write access to any local folder you target.

Copy install command View the source

Score: 73of 100
Rank: #150of 239
Installs: 20.5Kon skills.sh
Security: Warning 3 scanners
Updated: Nov 112026
Context: ~153tokens always

Install

npx skills add https://github.com/usestrix/strix --skill penetration-testing-with-strix

Run it in your terminal. View the source

Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app

What does penetration-testing-with-strix do?

penetration-testing-with-strix is a skill that runs Strix, an autonomous AI pentesting tool, against a web app, API, repository, domain or IP. Claude first chooses between the open-source CLI, which runs in a local Docker sandbox with your own LLM key, and the managed cloud at app.strix.ai, which needs sign-in and domain verification. Local scans run headless with strix -n, a target, a scan mode from quick to deep, and a --max-budget spending cap. Results land in strix_runs/ as a Markdown report, one file per validated finding with proof of concept, JSON, CSV and SARIF. It reminds Claude to scan only targets you own or may test.

When should you use penetration-testing-with-strix?

Use it when

You want exploitable bugs found in your staging app
You need SARIF output for GitHub code scanning
You want a security gate in CI

Skip it when

You don't own or have permission to test the target
You can't run Docker and won't use a cloud account

What it needs and what it can touch

You need

Docker and the Strix CLI
An LLM provider API key, or an app.strix.ai account

What it can do

Runs shell commands (strix, docker)
Mounts a local target folder writable inside the sandbox
Sends code or targets to Strix cloud and an LLM provider
Spends money up to the budget cap you set

From reading its instructions, not from running it.

Why it scores 73

Strongest on upkeep (100 of 100), weakest on adoption (49).

Adoption35 points 49
Upkeep20 points 100
Trust20 points 66
Quality15 points 100
Reader answers10 points Not enough answers yet, so this does not count

How the formula works

Is penetration-testing-with-strix safe to install?

At least one scanner rated it high risk, so we keep it out of the top ten. Read its code before you install it. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.

Scanner	Result	Date
Gen Agent Trust Hub	High risk	Oct 26, 2026
Socket	Medium risk	Oct 26, 2026
Snyk	Medium risk	Oct 26, 2026

Details

Installs: 20,510
Repository stars: 74,969
Last repository change: Nov 11, 2026
Tokens always loaded: about 153
Tokens when used: about 2,341
License: Apache-2.0
Data confidence: High

Alternatives to penetration-testing-with-strix

All skills for this job

security-review

For developers who want a security review of a file or diff that reports only confirmed, exploitable flaws.

Score 74 23.2K installs Official High-risk warning

Get security-review
security-review

For web developers adding login, payments, uploads or new API routes who want a security checklist at hand.

Score 70 20.2K installs

Get security-review
security-and-hardening

For web developers handling input, logins or personal data who want clear always, ask-first and never rules.

Score 77 82.7K installs

Get security-and-hardening
security-audit

For developers who want a source-based security review, from one question up to a full multi-agent audit.

Score 81 72.4K installs Official

Get security-audit