find-security-vulnerabilities-in-code
Find security vulnerabilities in a codebase or repository with Strix
by usestrixFree
Description
find-security-vulnerabilities-in-code is a Strix skill for white-box security review of a codebase or repository. The agents read the source to build a model of the routes, the dangerous sinks and the authorization checks, then attempt real exploitation of what they find. Each finding comes with a proof of concept, so the output is a short list of issues that were shown to work rather than the many potential hits a pattern-matching scanner produces. You can run it on a local working tree, on a GitHub repository by its URL, or on one service inside a monorepo, which is usually better than scanning the whole tree. Examples show the scan mode and a maximum budget per run, with a budget of around 15 to 20 for a typical scan. The skill points to the penetration-testing-with-strix skill for installation, LLM setup and flags, and to the managed cloud path for runs without Docker and without an LLM key. Because a scan spends model budget and reads your code, run it on repositories you own or are authorized to test. It suits teams that want a deeper review of a service than a linter gives, and it is most useful on code that handles authentication, data access and external input. It passes Gen Agent Trust Hub on skills.sh with a warning from Socket and Snyk. It has about 10,200 installs. Install it with npx skills add https://github.com/usestrix/strix --skill find-security-vulnerabilities-in-code.…
Highlights
- White-box review that reads routes, sinks and authorization checks
- Proof of concept for each reported finding
- Runs on a local tree, a GitHub URL or one monorepo service
- Scan mode and budget options per run
Ratings & Reviews
No ratings yet
Be the first to rate find-security-vulnerabilities-in-code.
People also visit
application-security-testing
Application security testing (AppSec) across a whole product with Strix
fix-security-vulnerabilities-with-strix
Fix security vulnerabilities found by a Strix pentest
security-audit
Comprehensive security auditing workflow covering web application testing
understand-dashboard
Launch the interactive web dashboard to visualize a codebase's knowledge graph
find-security-vulnerabilities-in-code FAQ
How is it different from a pattern scanner?
It reads the source to reason about the data flow and tries real exploitation, so findings come with a proof of concept.
What should I scan?
A local tree, a GitHub URL, or a single service in a monorepo, which is often the better target.
What does a run cost?
The examples set a maximum budget, around 15 to 20 per scan. The budget is a model-spend limit.
Where are installation details?
In the penetration-testing-with-strix skill, which covers install, LLM setup and flags.
How do I install it?
Run npx skills add https://github.com/usestrix/strix --skill find-security-vulnerabilities-in-code.
What are the best find-security-vulnerabilities-in-code alternatives?
Popular alternatives to find-security-vulnerabilities-in-code include security-audit, application-security-testing and fix-security-vulnerabilities-with-strix. See all find-security-vulnerabilities-in-code alternatives