Strix Code Vulnerability Scan
usestrix/strix
Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.
Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform
Install Security Architecture Validation
$ npx skills add Hack23/cia --skill security-architecture-validation -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install Hack23/cia security-architecture-validation --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/Hack23/cia.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.github/skills/security-architecture-validation .claude/skills/security-architecture-validation && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-architecture-validation" agent skill from https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validation into .claude/skills/security-architecture-validation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-architecture-validation", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validationType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add Hack23/cia --skill security-architecture-validation -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install Hack23/cia security-architecture-validation --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Hack23/cia.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.github/skills/security-architecture-validation .agents/skills/security-architecture-validation && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-architecture-validation" agent skill from https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validation into .agents/skills/security-architecture-validation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-architecture-validation", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Hack23/cia --skill security-architecture-validation -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install Hack23/cia security-architecture-validation --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Hack23/cia.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.github/skills/security-architecture-validation .cursor/skills/security-architecture-validation && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-architecture-validation" agent skill from https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validation into .cursor/skills/security-architecture-validation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-architecture-validation", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/Hack23/cia.git --path .github/skills/security-architecture-validation--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add Hack23/cia --skill security-architecture-validation -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install Hack23/cia security-architecture-validation --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Hack23/cia.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.github/skills/security-architecture-validation .gemini/skills/security-architecture-validation && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-architecture-validation" agent skill from https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validation into .gemini/skills/security-architecture-validation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-architecture-validation", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install Hack23/cia security-architecture-validationInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add Hack23/cia --skill security-architecture-validation -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/Hack23/cia.git skills-src && mkdir -p .github/skills && cp -r skills-src/.github/skills/security-architecture-validation .github/skills/security-architecture-validation && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-architecture-validation" agent skill from https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validation into .github/skills/security-architecture-validation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-architecture-validation", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add Hack23/cia --skill security-architecture-validation -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install Hack23/cia security-architecture-validation --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/Hack23/cia.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.github/skills/security-architecture-validation .opencode/skills/security-architecture-validation && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-architecture-validation" agent skill from https://github.com/Hack23/cia/tree/master/.github/skills/security-architecture-validation into .opencode/skills/security-architecture-validation/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-architecture-validation", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-architecture-validation- GitHub stars
- 239
- Token cost
- ~1.9k tokens
- SKILL.md length
- 467 words
- Files
- 1
- Skills in repo
- 78
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform
- Tasks that involve Software architecture
- SKILL.md covers Purpose, When to Use This Skill, Architecture Review Framework and Control Validation Matrix, plus 4 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Tasks that involve Penetration testing
What it does
Security Architecture Validation is an agent skill from Hack23/cia. Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform
Its SKILL.md is about 1.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Software architecture and Penetration testing. The repository describes itself as: Citizen Intelligence Agency. Open-source intelligence platform analyzing Swedish political activities using AI and data visualization. Tracks politicians, government… The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Software architecture
- Tasks that involve Penetration testing
Example prompts
- “/security-architecture-validation”
What it can do on your machine
Read from SKILL.md and the folder at commit 6a9797b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
owasp.orgcsrc.nist.gov
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Architecture Validation loads about 1.9k tokens when it runs. Until then it costs about 40 tokens; SKILL.md has 467 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from Hack23/cia at commit 6a9797b, republished under its Apache-2.0 licence (© Hack23). 467 words, ~1,872 tokens.
Download SKILL.mdSave it as
.claude/skills/security-architecture-validation/SKILL.md (or your agent's skills folder).- name
- security-architecture-validation
- description
- Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform
- license
- Apache-2.0
Security Architecture Validation Skill
Purpose
This skill provides structured guidance for validating the security architecture of the Citizen Intelligence Agency platform. It covers architecture reviews, control validation, penetration testing coordination, and compliance verification against ISMS requirements.
When to Use This Skill
Apply this skill when:
- ✅ Reviewing architecture changes for security impact
- ✅ Validating security controls are properly implemented
- ✅ Planning or reviewing penetration test results
- ✅ Preparing for compliance audits (ISO 27001, SOC 2)
- ✅ Assessing new integration points (APIs, data sources)
- ✅ Evaluating infrastructure changes (CloudFormation, AWS)
- ✅ Conducting periodic security architecture reviews
Do NOT use for:
- ❌ Line-by-line code review (use secure-code-review)
- ❌ Day-to-day coding practices (use secure-development-policy)
- ❌ Incident handling (use incident-response)
Architecture Review Framework
CIA Platform Security Layers
┌─────────────────────────────────────────┐
│ WAF / CloudFront │ Layer 1: Edge Security
├─────────────────────────────────────────┤
│ Load Balancer (ALB) │ Layer 2: Network
├─────────────────────────────────────────┤
│ Spring Security Filter Chain │ Layer 3: Application Auth
├─────────────────────────────────────────┤
│ Vaadin UI + Service Layer │ Layer 4: Business Logic
├─────────────────────────────────────────┤
│ JPA/Hibernate + PostgreSQL │ Layer 5: Data Access
├─────────────────────────────────────────┤
│ AWS VPC + Security Groups │ Layer 6: Infrastructure
└─────────────────────────────────────────┘Architecture Review Checklist
Authentication & Authorization:
□ Spring Security configured with secure defaults
□ Session management uses secure cookies (HttpOnly, Secure, SameSite)
□ Password storage uses bcrypt or Argon2
□ Role-based access control enforced at service layer
□ Admin endpoints protected with additional authentication
□ API authentication uses token-based mechanism
□ Session timeout configured appropriatelyNetwork Security:
□ TLS 1.2+ enforced for all connections
□ HSTS header configured
□ Security groups follow least privilege
□ Database not publicly accessible
□ VPC subnets properly segmented
□ Outbound traffic restricted to required destinationsData Protection:
□ Data at rest encrypted (RDS, EBS, S3)
□ Data in transit encrypted (TLS)
□ Sensitive fields encrypted at application level
□ Database credentials managed via AWS Secrets Manager
□ No PII in application logs
□ Backup encryption enabledControl Validation Matrix
| Control Domain | Expected Control | Validation Method | Evidence |
|---|---|---|---|
| Access Control | RBAC via Spring Security | Config review + test | SecurityConfig.java |
| Encryption | TLS 1.2+ all connections | SSL scan | CloudFormation template |
| Input Validation | All user inputs validated | Code review + DAST | Controller layer review |
| Audit Logging | Security events logged | Log review | Logback configuration |
| Session Mgmt | Secure session handling | Config review | Spring Security config |
| Error Handling | No info leakage | DAST + code review | Exception handlers |
| CSRF | Token-based protection | Config review + test | Spring Security config |
| SQL Injection | Parameterized queries only | SAST + code review | JPA repositories |
| XSS Prevention | Output encoding | DAST + code review | Vaadin components |
| Dependency Mgmt | No critical CVEs | OWASP DC scan | CI/CD pipeline |
Penetration Testing Guidance
Scope Definition
In Scope:
- Web application (Vaadin UI + REST APIs)
- Authentication and session management
- Authorization boundaries between roles
- Input validation across all entry points
- External API integrations (Riksdag, World Bank)
- CloudFormation-deployed infrastructure
Out of Scope:
- Third-party services (GitHub, AWS managed services)
- Physical security
- Social engineering
- Denial of service attacks
Show full SKILL.md (185 more words)Show less
Test Categories
| Category | Focus Areas | OWASP Reference |
|---|---|---|
| Authentication | Login, session, password reset | A07:2021 |
| Authorization | Role escalation, IDOR | A01:2021 |
| Injection | SQL, XSS, Command injection | A03:2021 |
| Configuration | Headers, TLS, error pages | A05:2021 |
| Data Exposure | PII leakage, API responses | A02:2021 |
| Components | Known vulnerable dependencies | A06:2021 |
| Logging | Audit trail completeness | A09:2021 |
Penetration Test Report Template
## Finding: [Title]
- **Severity:** Critical / High / Medium / Low
- **CVSS Score:** X.X
- **OWASP Category:** AXX:2021
- **Affected Component:** [Component name]
- **Description:** [What was found]
- **Impact:** [Business impact]
- **Reproduction Steps:** [Step-by-step]
- **Remediation:** [How to fix]
- **ISO 27001 Control:** [Relevant control]
- **Status:** Open / In Progress / ResolvedCompliance Verification
ISO 27001:2022 Architecture Controls
| Control | Requirement | CIA Implementation | Status |
|---|---|---|---|
| A.8.1 | User endpoint devices | N/A (server-side app) | N/A |
| A.8.3 | Information access restriction | Spring Security RBAC | ✅ |
| A.8.5 | Secure authentication | Spring Security + bcrypt | ✅ |
| A.8.9 | Configuration management | CloudFormation IaC | ✅ |
| A.8.15 | Logging | SLF4J + CloudWatch | ✅ |
| A.8.20 | Network security | VPC + Security Groups | ✅ |
| A.8.24 | Use of cryptography | TLS + encrypted storage | ✅ |
| A.8.25 | Secure development lifecycle | CI/CD security gates | ✅ |
| A.8.26 | Application security requirements | Security requirements | ✅ |
| A.8.28 | Secure coding | SAST + code review | ✅ |
Validation Frequency
| Validation Activity | Frequency | Responsible |
|---|---|---|
| Architecture review | Quarterly + major changes | Security lead |
| Control validation | Monthly automated + quarterly manual | DevSecOps |
| Penetration testing | Annually + major releases | External firm |
| Compliance audit | Annual (ISO 27001 certification) | Auditor |
| Dependency review | Weekly automated | Dependabot + manual |
| Configuration review | Monthly | DevSecOps |
Decision Framework
Architecture Change Proposed
│
├─→ Does it change authentication/authorization?
│ └─→ YES → Full security architecture review required
│
├─→ Does it add new external integrations?
│ └─→ YES → Threat model update + data flow review
│
├─→ Does it change data storage or processing?
│ └─→ YES → Data classification review + encryption check
│
├─→ Does it modify infrastructure (CloudFormation)?
│ └─→ YES → Infrastructure security review
│
└─→ Does it change network boundaries?
└─→ YES → Network security review + firewall rulesReferences
© Hack23, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .github/skills/security-architecture-validation of Hack23/cia.
Open the folder on GitHubat commit 6a9797b
Compare with similar skills
Security Architecture Validation next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Architecture Validation this skillHack23/cia | 239 | — | ~1.9k | Automated safety check: Pass | Apache-2.0 | |
| Strix Code Vulnerability Scanusestrix/strix | 67k | — | ~1.1k | Automated safety check: Pass | Apache-2.0 | |
| Code Audit3stoneBrother/code-audit | 893 | 1 repos | ~2.7k | Automated safety check: Pass | None | |
| Fix Strix Security Findingsusestrix/strix | 67k | — | ~1.5k | Automated safety check: Pass | Apache-2.0 | |
| Metabigor OSINT Reconj3ssie/metabigor | 1.8k | — | ~2.4k | Automated safety check: Pass | MIT | |
| Wooyun Legacytanweai/wooyun-legacy | 1.8k | — | ~1.9k | Automated safety check: Pass | Custom licence |
Similar skills
Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
Fix Strix Security Findings
usestrix/strix
Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.
Metabigor OSINT Recon
j3ssie/metabigor
Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.
Wooyun Legacy
tanweai/wooyun-legacy
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…
OWASP Top 10 Testing with Strix
usestrix/strix
Runs Strix's autonomous exploit agents against each OWASP Top 10:2025 category and the API Security Top 10, reporting only what could actually be proven with a proof-of-concept.
More from Hack23/cia
All 78 skills in this repoAccessibility Wcag Patterns
Hack23/cia
WCAG 2.1 AA compliance, ARIA attributes, keyboard navigation, screen reader optimization for accessible political data platforms
Advanced Data Visualization
Hack23/cia
Advanced chart types, D3.js/Vaadin Charts patterns, political data visualization, time series analysis
AI Governance
Hack23/cia
AI governance, EU AI Act compliance, OWASP LLM security, responsible AI practices for GitHub Copilot agents
API Integration
Hack23/cia
External API integration patterns, retry logic, circuit breakers, caching, rate limiting for government data APIs
AWS Cloudwatch Monitoring
Hack23/cia
AWS CloudWatch metrics, alarms, dashboards, log insights, and application monitoring for the CIA platform
AWS Security Architecture
Hack23/cia
AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment
Related
Categories
Questions about Security Architecture Validation
What does Security Architecture Validation do?
Security architecture review, control validation, penetration testing guidance, and compliance verification for the CIA platform. Security Architecture Validation is an agent skill from Hack23/cia.
When should I use Security Architecture Validation?
Security Architecture Validation fits situations like: tasks that involve Software architecture; tasks that involve Penetration testing.
How do I install Security Architecture Validation in Claude Code?
Run `npx skills add Hack23/cia --skill security-architecture-validation -a claude-code`. Or copy the skill folder (.github/skills/security-architecture-validation in Hack23/cia) into .claude/skills/security-architecture-validation in your project. Claude Code loads it when a task matches its description.
How do I install Security Architecture Validation in Codex?
Run `npx skills add Hack23/cia --skill security-architecture-validation -a codex`. Or copy the skill folder (.github/skills/security-architecture-validation in Hack23/cia) into .agents/skills/security-architecture-validation in your project. Codex loads it when a task matches its description.
Can I use Security Architecture Validation in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add Hack23/cia --skill security-architecture-validation -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-architecture-validation, .gemini/skills/security-architecture-validation, .github/skills/security-architecture-validation and .opencode/skills/security-architecture-validation in your project.
What does Security Architecture Validation need to run?
SKILL.md names no scripts, command-line tools or credentials: Security Architecture Validation is instructions for the agent only.
Does Security Architecture Validation access the network?
SKILL.md names 2 domains. As links in the text: owasp.org and csrc.nist.gov. This is read from the text; nothing was executed.
Is Security Architecture Validation safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Architecture Validation use?
Security Architecture Validation is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Architecture Validation use?
About 1.9k tokens (SKILL.md is roughly 7.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Architecture Validation?
Skills that share tags, products or a category with Security Architecture Validation: Strix Code Vulnerability Scan (usestrix/strix, 67k stars), Code Audit (3stoneBrother/code-audit, 893 stars), Fix Strix Security Findings (usestrix/strix, 67k stars) and Metabigor OSINT Recon (j3ssie/metabigor, 1.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Architecture Validation?
Hack23 (a GitHub organization) maintains it in Hack23/cia, which has 239 GitHub stars. The repository holds 78 skills in this directory. The repository was last updated on October 6, 2026.
Source: Hack23/cia on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.