# Find Code Vulnerabilities

Finds code vulnerabilities and proves them with working exploits in a sandbox.

- Repository: https://github.com/usestrix/strix (73218 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code -g -a claude-code -y`
Codex: `npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code -g -a codex -y`
Cursor: `npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code -g -a cursor -y`
Gemini CLI: `npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code -g -a gemini-cli -y`

## Description

Find security vulnerabilities in a codebase or repository with Strix, a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Find security vulnerabilities in code

White-box security review with Strix: the agents read the source to build a model of routes, sinks, and authorization checks, then attempt real exploitation. Findings come with a proof-of-concept, so the output is a short list of proven issues rather than the hundreds of "potential" hits a pattern-matching scanner produces.

Install, LLM setup, all flags, and the managed-cloud path are in the **penetration-testing-with-strix** skill. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**).

## Run it

```bash
# Local working tree
strix -n -t ./ --scan-mode standard --max-budget 15

# A GitHub repo directly
strix -n -t https://github.com/org/app --max-budget 15

# Monorepo: point at the service that matters, not the whole tree
strix -n -t ./services/checkout --max-budget 20

# Only what a branch changed (whole-repo review is wasteful on a large repo)
strix -n -t ./ --scope-mode diff --diff-base origin/main --max-budget 10
```

A local path is mounted into the sandbox **writable**, so the agents can modify it. Run against a clean checkout.

Two things sharply improve results:

The rest: https://github.com/usestrix/strix/blob/HEAD/skills/find-security-vulnerabilities-in-code/SKILL.md