# Strix: Find Security Vulnerabilities in Code (find-security-vulnerabilities-in-code)

> White-box security review with Strix: reads source for data flow and authorization, then attempts exploitation in a sandbox with a PoC.

- Category: [Security Audit](https://www.myskills.tools/en/categories/security-audit/)
- Source: Official · Strix
- Repository: https://github.com/usestrix/strix/tree/main/skills/find-security-vulnerabilities-in-code (commit 42baa7c)
- SKILL.md: https://github.com/usestrix/strix/blob/main/skills/find-security-vulnerabilities-in-code/SKILL.md
- Install command: `npx skills add usestrix/strix --skill find-security-vulnerabilities-in-code`
- License: Apache-2.0
- Compatible with: Claude Code, Codex, Cursor
- Permissions: read-repo ✓, write-files ✓, shell ✓, network ✓
- Status: Scan passed
- A rule scan cannot catch every risk. Read this skill's SKILL.md and check its permissions before installing.
- ⚠ Requires the Strix CLI plus Docker and an LLM key, or a Strix cloud login; runs incur model costs.

## Core rule

Check each PoC demonstrates impact before reporting; exit 0 means nothing exploitable was proven, not that the code is clean.

## Execution Phases

1. **Scope the review** — Point at the risky subtree or the branch diff, and state the tenancy model, trust boundaries and attacker-controlled inputs.
2. **Run Strix** — Run strix on a local tree or GitHub repo with --max-budget; add a running instance as a target to confirm exploitability.
3. **Read the results** — Start with penetration_test_report.md, then open each finding under vulnerabilities/ and check the PoC, file and line.
4. **Fix and re-verify** — Hand off to the companion fix skill for the root cause, re-run Strix to confirm the exploit fails, and keep SCA and secret scanning in place.

## Permissions (summarised from SKILL.md)

| Capability | Needed | Details |
|---|---|---|
| File writes | Limited | A local path is mounted writable into the sandbox and agents can modify it, so run on a clean checkout; results go to strix_runs/. |
| Command execution | Limited | Runs the Strix CLI, which executes its agents and exploit attempts in a Docker sandbox. |
| Network outbound | Limited | Calls the configured LLM provider and the named repo or app targets; cloud mode uses the Strix managed platform. |

## SKILL.md frontmatter (YAML)

```yaml
---
name: find-security-vulnerabilities-in-code
description: Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.
license: Apache-2.0
metadata:
  author: usestrix
  homepage: https://docs.strix.ai
---
```

Home: https://www.myskills.tools/en/ · URL: https://www.myskills.tools/en/skills/find-security-vulnerabilities-in-code/