Strix Pentest

Name: Strix Pentest
Author: romangalaxys10-spec

ASecurity

Derived from the [`usestrix/strix`](https://github.com/usestrix/strix.git) multi-agent security framework. > **Zero False Positives Invariant**: Strix only reports a vulnerability if it drafts, executes, and validates a working Proof-of-Concept (PoC) exploit in an isolated sandbox. Theoretical alerts without executable verification are rejected. ---

4 stars
0 votes
0 copies
1 view
Added October 7, 2026

ai-agentsgosqlawstestinggitsecurity

Works with

Security analysis

A100/100

Scanned October 7, 2026

npx -y skills add romangalaxys10-spec/fable --skill strix-pentest --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Strix Pentest?

Add the live security badge to your README. It updates with every re-scan.

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/romangalaxys10-spec-strix-pentest/badge)](https://www.skillsdirectory.com/skills/romangalaxys10-spec-strix-pentest)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: strix-pentest
title: Autonomous Agentic Penetration Testing & Exploit Verification
source: https://github.com/usestrix/strix.git
category: Offensive Security & Vulnerability Assessment
version: 1.0.0
license: Apache-2.0
---

# strix-pentest — Autonomous Agentic Penetration Testing

Derived from the [`usestrix/strix`](https://github.com/usestrix/strix.git) multi-agent security framework.

> **Zero False Positives Invariant**: Strix only reports a vulnerability if it drafts, executes, and validates a working Proof-of-Concept (PoC) exploit in an isolated sandbox. Theoretical alerts without executable verification are rejected.

---

## 1. Vulnerability Classes Covered (OWASP Top 10 + Logic Flaws)

1. **Broken Access Control (BAC / IDOR)**: Accessing tenant B resource via tenant A JWT / session.
2. **Injection Attacks**:
   - SQL Injection (error-based, blind time-based, union-based).
   - OS Command Injection (`exec`, `child_process`, `eval`).
   - Server-Side Template Injection (SSTI).
3. **Server-Side Request Forgery (SSRF)**: Reaching internal cloud metadata (`169.254.169.254`, `localhost`, VPC endpoints).
4. **Client-Side Attacks**: Cross-Site Scripting (Reflected, Stored, DOM-based XSS) and CSRF.
5. **XML External Entity (XXE) & Insecure Deserialization**.
6. **Authentication & Session Flaws**: Weak JWT signing, missing token expiration, session fixation.
7. **Business Logic Flaws**: Race conditions on promo codes, negative balances, price manipulation.

---

## 2. Multi-Agent Pentesting Pipeline

```
[Target Code / Endpoint] ──▶ [Reconnaissance Agent] ──▶ [Attack Surface Map]
                                                              │
                                                              ▼
                                                   [Vulnerability Hunter]
                                                              │ (Drafts exploit payload)
                                                              ▼
                                                   [Sandbox Exploit Runner]
                                                              │
                              ┌───────────────────────────────┴───────────────────────────────┐
                              ▼                                                               ▼
                     [PoC Exploit Confirmed]                                        [Exploit Failed / Defended]
              Vulnerability Confirmed (100% True Positive)                            Discarded (Zero False Positives)
              Generates: CVSS v3.1 + PoC Script + Remediation PR
```

---

## 3. Exploit Evidence Bundle Contract

For every confirmed finding, Strix produces:
- `vulnerabilityId`: e.g. `STRIX-2026-BAC-001`
- `cwe`: CWE-639 (Insecure Direct Object Reference)
- `cvss`: Base score 8.6 (High)
- `reproductionSteps`: Exact cURL command or Playwright attack script.
- `proofOfConcept`: Observed unauthorized payload / data exfiltration.
- `remediationDiff`: Exact contiguous patch closing the vulnerability.