Authorization notice. Strix is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.
Remote script. The skill install runs npx against a remote package, so check the source before installing it into an agent.
Who it is forA developer who works with a coding agent and wants the agent to handle security findings end to end.
The problemSecurity findings often sit in a backlog because fixing them takes context switching.
The outcomeA coding agent that runs Strix against the project, reads the findings, and proposes or applies fixes.
What you need first
- Docker installed and running
- An LLM API key from a supported provider, or a ChatGPT Plus/Pro subscription sign-in
- The application source directory or a target URL you are authorized to test
- A GitHub repository with Actions enabled, if you want the CI workflow
Steps
- Run
npx skills add usestrix/strixin your project. - Open your coding agent (Claude Code, Cursor, or Codex) in the project directory.
- Ask the agent to run a Strix pentest on the project and list the findings.
- Ask the agent to fix one finding, then run the Strix scan again to confirm it is resolved.
Prompt for your agent
Install the usestrix/strix skills with `npx skills add usestrix/strix`, then run a Strix pentest on <project-directory>. Fix the highest-severity finding and rerun the scan. Verify that the rerun no longer reports that finding before you report success.
Caveat. The README says the skills work with the local CLI or the managed cloud, but the setup steps depend on the agent you use and the README does not detail them per agent.
Use this in your AI agent
Ask your agent
Using the Deduped MCP, get the setup steps for usestrix/strix and "Let a coding agent run pentests and fix findings"
Add Deduped to Claude Code once
claude mcp add --transport http deduped https://dedupedai.com/mcp
Every Monday: the 5 hottest repos and exactly how to use them. Free, one email a week, unsubscribe anytime.
Get them freeShare: X LinkedIn Hacker News Email Copy link
Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer