Find Code Vulnerabilities
Finds code vulnerabilities and proves them with working exploits in a sandbox.
Install
npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code -g -a claude-code -y- Repository
- usestrix/strix73.2k
- Category
- Security
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Lightabout 906 tokens
- Runs scripts
- No, instructions only
What it does
Find security vulnerabilities in a codebase or repository with Strix, a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
Find security vulnerabilities in code
White-box security review with Strix: the agents read the source to build a model of routes, sinks, and authorization checks, then attempt real exploitation. Findings come with a proof-of-concept, so the output is a short list of proven issues rather than the hundreds of "potential" hits a pattern-matching scanner produces.
Install, LLM setup, all flags, and the managed-cloud path are in the penetration-testing-with-strix skill. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix).
Run it
# Local working tree
strix -n -t ./ --scan-mode standard --max-budget 15
# A GitHub repo directly
strix -n -t https://github.com/org/app --max-budget 15
# Monorepo: point at the service that matters, not the whole tree
strix -n -t ./services/checkout --max-budget 20
# Only what a branch changed (whole-repo review is wasteful on a large repo)
strix -n -t ./ --scope-mode diff --diff-base origin/main --max-budget 10
A local path is mounted into the sandbox writable, so the agents can modify it. Run against a clean checkout.
Two things sharply improve results:
