Self-hosted alternatives to find-security-vulnerabilities-in-code

F

find-security-vulnerabilities-in-code

Find security vulnerabilities in a codebase or repository with Strix

find-security-vulnerabilities-in-code is a Strix skill for white-box security review of a codebase or repository. The agents read the source to build a model of the routes, the dangerous sinks and the authorization checks, then attempt real exploitation of what they find. Each finding comes with a proof of concept, so the output is a short list of issues that were shown to work rather than the many potential hits a pattern-matching scanner produces. You can run it on a local working tree, on a GitHub repository by its URL, or on one service inside a monorepo, which is usually better than scanning the whole tree. Examples show the scan mode and a maximum budget per run, with a budget of around 15 to 20 for a typical scan. The skill points to the penetration-testing-with-strix skill for installation, LLM setup and flags, and to the managed cloud path for runs without Docker and without an LLM key. Because a scan spends model budget and reads your code, run it on repositories you own or are authorized to test. It suits teams that want a deeper review of a service than a linter gives, and it is most useful on code that handles authentication, data access and external input. It passes Gen Agent Trust Hub on skills.sh with a warning from Socket and Snyk. It has about 10,200 installs. Install it with npx skills add https://github.com/usestrix/strix --skill find-security-vulnerabilities-in-code.