These skills let an agent review code for vulnerabilities, run penetration-testing workflows against a web app or API, and dig into compiled binaries. The page brings together Strix testing, hardening, dependency review, and reverse engineering.
26 skillssecurity skill for Claude AI. Grade A. Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.
Binary investigation and Android kernel CVE research using the remote Dr. Binary MCP service.
Review an AI agent Skill before installation using static scanning and source-aware security analysis.
Review web security, compatibility, browser APIs and code-quality practices.
Organize authorized defensive reverse engineering of binaries and protocols.
Ask Claude Code or Codex how one app feature works, get the code evidence, and plan your own implementation with REA.
Review code for security, correctness, performance, maintainability and testing gaps.
Threat-model sensitive code and apply security controls for input, authentication, dependencies and personal data.
Produce a ranked repository audit covering bugs, risky untested code, slow paths and code bloat.
Audit the repository or a broad subsystem for security, correctness, and maintainability risks.
Investigate executable files using remote triage, targeted analysis and optional decompilation.
Check resolved dependencies and relevant code paths for security vulnerabilities.
Audit a codebase for architecture, quality, security and testing issues.
Review a change and its connected code for correctness, safety, performance and unnecessary complexity.
Query Android kernel CVEs by identifier, version, branch or build date using a remote database.
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan.
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them.
Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit.
Review security boundaries and investigate evidence-backed vulnerabilities across code, APIs, services and command-line tools.
Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match.
Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert.
Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed.
Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional…
Review code, test web applications and APIs, verify fixes and integrate Strix security scans into CI.
Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning.
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level…
Compare five security Skills for source audits, secure implementation, Skill inspection, and authorized web and API penetration testing.
Start from the artifact: source code points to review or hardening, a running app points to a pentest workflow, and a binary points to reverse-engineering tools. Have a person review the findings before acting on them.