These skills let an agent inspect application code, exercise a web target, and turn findings into remediation work. The page brings together code review, OWASP testing, penetration workflows, hardening, and binary or CVE analysis.
25 skillssecurity skill for Claude AI. Grade A. Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.
Binary investigation and Android kernel CVE research using the remote Dr. Binary MCP service.
Review an AI agent Skill before installation using static scanning and source-aware security analysis.
Review web security, compatibility, browser APIs and code-quality practices.
Organize authorized defensive reverse engineering of binaries and protocols.
Threat-model sensitive code and apply security controls for input, authentication, dependencies and personal data.
Audit the repository or a broad subsystem for security, correctness, and maintainability risks.
Investigate executable files using remote triage, targeted analysis and optional decompilation.
Check resolved dependencies and relevant code paths for security vulnerabilities.
Audit a codebase for architecture, quality, security and testing issues.
Query Android kernel CVEs by identifier, version, branch or build date using a remote database.
Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan.
Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth/access-control flaws, IDOR, business logic) instead of just flagging them.
Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit.
Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match.
Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed.
Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional…
Review code, test web applications and APIs, verify fixes and integrate Strix security scans into CI.
Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning.
Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level…
Compare five security Skills for source audits, secure implementation, Skill inspection, and authorized web and API penetration testing.
Use code review and OWASP entries for source and dependency findings, penetration entries for a running target, and binary analysis when the evidence is compiled code. A person should make the final risk decision.