Self-hosted alternatives to application-security-testing

A

application-security-testing

Application security testing (AppSec) across a whole product with Strix

application-security-testing is an entry-point skill from the Strix project for requests to make an application secure, where the target is not yet a single URL or repository. It picks the right test for each asset, such as source code, a running web app, an API or a CI pipeline, runs them, and produces one ranked plan rather than running everything at maximum depth. Its first step maps the assets: the source, whether it is one repository or several services and which languages it uses, the running environments such as staging, production or a local dev server, the APIs and their schemas, whether two test accounts in different tenants are available, and the constraints on the job, such as out-of-scope paths and the time and budget limits. The skill is firm that testing is done only on assets you own or are authorized to test, and it asks for that confirmation before the first run. It prefers staging over production because the agents send exploit payloads and can change data. If there is no staging environment and production is off limits, the skill says a code-only review is still useful but cannot prove that anything is exploitable on a live app. It passes Gen Agent Trust Hub and Snyk on skills.sh, and Socket shows a warning. It has about 10,000 installs. Install it with npx skills add https://github.com/usestrix/strix --skill application-security-testing.