Description
ci-security-scanning-with-strix is a skill from the Strix project for adding security scanning to CI/CD, on GitHub Actions, GitLab CI or any pipeline, so that each pull request gets a diff-scoped AI pentest that can block the merge. It describes two ways to gate pull requests, which you can combine. The managed platform is connected once to the GitHub, GitLab or Bitbucket app, and it reviews every pull request with no workflow file, no runner and no LLM key, posting results as pull request comments and into a team dashboard. The self-hosted open-source CLI runs as a pipeline step inside your runner. It needs Docker on the runner and your own LLM key, and it is the choice for air-gapped or self-hosted CI. The self-hosted scan tests only the changed files, uses quick mode to stay fast, and returns exit code 2 when validated vulnerabilities are found, which fails the build. Both routes emit SARIF 2.1.0, so you can start with one and add the other later. The skill gives the GitHub Actions workflow for the self-hosted route, written as a security workflow file in .github/workflows. It is for teams that want security findings to appear as part of review, not as a separate audit later. It passes Gen Agent Trust Hub and Socket on skills.sh, and Snyk shows a warning. It has about 12,900 installs. Install it with npx skills add https://github.com/usestrix/strix --skill ci-security-scanning-with-strix.…
Highlights
- Diff-scoped AI pentest on every pull request
- Managed platform route with no runner or LLM key
- Self-hosted CLI route for air-gapped or private CI
- Fails the build with exit code 2 on validated findings
- SARIF 2.1.0 output from both routes
Ratings & Reviews
No ratings yet
Be the first to rate ci-security-scanning-with-strix.
People also visit
agent-workflow-automation
Agent skill for workflow-automation - invoke with $agent-workflow-automation
create-github-action-workflow-specification
Generates formal, AI-optimized specifications for GitHub Actions workflows
github-actions-efficiency
Audit GitHub Actions workflow efficiency and recommend fixes
golang-continuous-integration
GitHub Actions CI/CD pipeline configuration for Golang projects
ci-security-scanning-with-strix FAQ
What does a pull request scan test?
Only the changed files, in quick mode, to keep the check fast.
When does the build fail?
The self-hosted scan exits with code 2 when validated vulnerabilities are found.
Which route should I use?
The managed platform needs no runner or LLM key. The self-hosted CLI keeps everything in your infrastructure and needs Docker on the runner and your own LLM key.
What output format is used?
SARIF 2.1.0 from both routes.
How do I install it?
Run npx skills add https://github.com/usestrix/strix --skill ci-security-scanning-with-strix.
What are the best ci-security-scanning-with-strix alternatives?
Popular alternatives to ci-security-scanning-with-strix include agent-workflow-automation, github-workflow-automation and github-automation. See all ci-security-scanning-with-strix alternatives