Code Audit
3stoneBrother/code-audit
Professional code security audit skill covering 55+ vulnerability types.
Runs Strix's autonomous exploit agents against each OWASP Top 10:2025 category and the API Security Top 10, reporting only what could actually be proven with a proof-of-concept.
Install OWASP Top 10 Testing with Strix
$ npx skills add usestrix/strix --skill owasp-top-10-testing -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install usestrix/strix owasp-top-10-testing --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/usestrix/strix.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/owasp-top-10-testing .claude/skills/owasp-top-10-testing && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "owasp-top-10-testing" agent skill from https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testing into .claude/skills/owasp-top-10-testing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-top-10-testing", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testingType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add usestrix/strix --skill owasp-top-10-testing -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install usestrix/strix owasp-top-10-testing --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/usestrix/strix.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/owasp-top-10-testing .agents/skills/owasp-top-10-testing && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "owasp-top-10-testing" agent skill from https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testing into .agents/skills/owasp-top-10-testing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-top-10-testing", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add usestrix/strix --skill owasp-top-10-testing -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install usestrix/strix owasp-top-10-testing --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/usestrix/strix.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/owasp-top-10-testing .cursor/skills/owasp-top-10-testing && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "owasp-top-10-testing" agent skill from https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testing into .cursor/skills/owasp-top-10-testing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-top-10-testing", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/usestrix/strix.git --path skills/owasp-top-10-testing--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add usestrix/strix --skill owasp-top-10-testing -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install usestrix/strix owasp-top-10-testing --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/usestrix/strix.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/owasp-top-10-testing .gemini/skills/owasp-top-10-testing && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "owasp-top-10-testing" agent skill from https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testing into .gemini/skills/owasp-top-10-testing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-top-10-testing", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install usestrix/strix owasp-top-10-testingInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add usestrix/strix --skill owasp-top-10-testing -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/usestrix/strix.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/owasp-top-10-testing .github/skills/owasp-top-10-testing && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "owasp-top-10-testing" agent skill from https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testing into .github/skills/owasp-top-10-testing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-top-10-testing", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add usestrix/strix --skill owasp-top-10-testing -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install usestrix/strix owasp-top-10-testing --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/usestrix/strix.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/owasp-top-10-testing .opencode/skills/owasp-top-10-testing && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "owasp-top-10-testing" agent skill from https://github.com/usestrix/strix/tree/main/skills/owasp-top-10-testing into .opencode/skills/owasp-top-10-testing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "owasp-top-10-testing", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
owasp-top-10-testing- GitHub stars
- 67k
- Token cost
- ~1.6k tokens
- SKILL.md length
- 641 words
- Files
- 1
- Skills in repo
- 4
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Runs Strix's autonomous exploit agents against each OWASP Top 10:2025 category and the API Security Top 10, reporting only what could actually be proven with a proof-of-concept.
- Running an OWASP Top 10 compliance assessment against a live application
- SKILL.md covers What is and is not testable by…, Run it, Report honestly and Then fix and re-test
- Reaches github.com
- Checking an app for SSRF, IDOR or privilege escalation with proof-of-concept exploits
What it does
The skill treats OWASP Top 10 testing as exercising each risk category against the real application rather than running a checklist, and defaults to the 2025 edition, asking the user before testing against the older 2021 edition since a report labeled with the wrong edition is misleading. It names what changed between editions: SSRF folded into A01, A03 Software Supply Chain Failures expanding the old outdated-components category, and a new A10 for mishandling exceptional conditions.
It is explicit about coverage limits rather than claiming a clean sweep: access control issues including SSRF, security misconfiguration and injection are exploit-validated as strong coverage, while software supply chain and cryptographic failures are only partially testable by a runtime scan, since build-system compromise and at-rest key management need source or infrastructure review instead. A no-Docker, no-local-LLM-key path exists through Strix's managed cloud platform, started with strix cloud login and strix cloud scans start.
When your agent uses it
- Running an OWASP Top 10 compliance assessment against a live application
- Checking an app for SSRF, IDOR or privilege escalation with proof-of-concept exploits
- Testing against the OWASP API Security Top 10
Example prompts
- “Run an OWASP Top 10:2025 assessment against staging.example.com.”
- “Test our API for OWASP API Security Top 10 issues using Strix's cloud scan.”
- “Check for SSRF and IDOR on this app, with proof before reporting anything.”
Requirements
- The Strix CLI
- Docker and an LLM key, or Strix's managed cloud platform
What it can do on your machine
Read from SKILL.md and the folder at commit 62b4964. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
github.com
Also links to:
owasp.org
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
OWASP Top 10 Testing with Strix loads about 1.6k tokens when it runs. Until then it costs about 181 tokens; SKILL.md has 641 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from usestrix/strix at commit 62b4964, republished under its Apache-2.0 licence (© usestrix). 641 words, ~1,552 tokens.
Download SKILL.mdSave it as
.claude/skills/owasp-top-10-testing/SKILL.md (or your agent's skills folder).- name
- owasp-top-10-testing
- description
- Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.
- license
- Apache-2.0
- metadata.author
- usestrix
- metadata.homepage
- https://docs.strix.ai
Test against the OWASP Top 10
The OWASP Top 10 is a taxonomy of risk categories, not a test suite — "OWASP Top 10 testing" means exercising each category against the real application and reporting what's actually exploitable. Strix's agents do the exploitation; this skill covers running it category-by-category and reporting coverage honestly.
Use the current edition: OWASP Top 10:2025 (8th installment, superseding 2021). Ask the user before targeting an older edition — some compliance checklists still reference 2021, and a report labelled with the wrong edition is misleading. Key differences from 2021: SSRF is folded into A01, A03 Software Supply Chain Failures expands the old "Vulnerable and Outdated Components", and A10 Mishandling of Exceptional Conditions is new; A02 Security Misconfiguration moved 5→2.
Install, LLM setup, and the managed-cloud alternative: penetration-testing-with-strix. For a run with no Docker and no LLM key, the same binary drives the managed platform: strix cloud login, then strix cloud scans start ... (details in managed-pentesting-with-strix).
What is and is not testable by an agent
Be straight with the user about this — claiming a clean sweep of all ten is misleading.
| Category (2025) | Coverage |
|---|---|
| A01 Broken Access Control (incl. SSRF) | Strong — cross-user/tenant access, privilege escalation, IDOR, and SSRF (including blind, via out-of-band callbacks) are all exploit-validated. Needs two accounts plus a privileged one to prove the authorization half. |
| A02 Security Misconfiguration | Strong — debug endpoints, verbose errors, permissive CORS, missing hardening, default credentials, exposed admin surfaces. |
| A03 Software Supply Chain Failures | Partial — version fingerprinting, and vulnerable/outdated dependency review when source is supplied. Build-system and distribution-infrastructure compromise (the broader half of this category) is out of scope for a runtime scan — pair with SCA plus build-provenance controls. |
| A04 Cryptographic Failures | Partial — transport config, unencrypted data in transit, secrets and tokens leaked in responses. At-rest crypto and key management need source or infra review. |
| A05 Injection | Strong — SQL/NoSQL/command/template injection and XSS, exploit-validated. |
| A06 Insecure Design | Partial — business-logic abuse (price/quantity tampering, workflow skipping, race conditions) is found where reachable; design intent still needs human review and threat modelling. |
| A07 Authentication Failures | Strong — auth bypass, weak session/token handling, password-reset and MFA flaws. |
| A08 Software or Data Integrity Failures | Partial — insecure deserialization and unsigned-update paths where reachable; CI/CD trust boundaries are not runtime-testable. |
| A09 Security Logging & Alerting Failures | Not testable from outside — requires reviewing the logging and alerting pipeline. State this rather than reporting it as passed. |
| A10 Mishandling of Exceptional Conditions | Partial — agents actively probe error handling and fail-open behavior (malformed input, forced errors, race and timeout conditions) and report what leaks or bypasses a control; exhaustive coverage of internal error paths needs source review. |
For APIs, run the same exercise against the OWASP API Security Top 10 (2023) — API1 BOLA, API3 Broken Object Property Level Authorization (2019's excessive data exposure + mass assignment merged), API5 broken function-level authorization — using the api-security-testing skill.
Show full SKILL.md (173 more words)Show less
Run it
Maximum category coverage comes from giving the agents both the source and a running instance, plus credentials at two privilege levels:
strix -n \
-t https://github.com/org/app \
-t https://staging.example.com \
--scan-mode deep --max-budget 30 \
--instruction "OWASP Top 10:2025 assessment. Cover every category systematically and map each finding to its 2025 category id.
Accounts: userA@example.com/<pw> (org 1), userB@example.com/<pw> (org 2), admin@example.com/<pw>.
Prioritise A01 (cross-org access, privilege escalation, SSRF), A02, A05, A07, A10.
Out of scope: /billing/*, outbound email."--scan-mode deepmatters here: systematically walking ten categories is not a quick scan.- Without a second account, A01 results are structurally incomplete — say so in the report rather than leaving it implied.
- Need an auditor-facing PDF? Run it through the managed platform and pull the technical report (managed-pentesting-with-strix).
Report honestly
From strix_runs/<run>/, group vulnerabilities/*.md by category and state, per category: what was attempted, what was proven, and what could not be assessed (A09 always; A03/A04/A06/A08/A10 partially). Label the report with the edition used. Verify each PoC yourself before it goes in front of the user.
A 0 exit code means nothing exploitable was proven in what was analyzed — check run.json status and cost against --max-budget; a budget-capped run is not a completed assessment.
Then fix and re-test
Remediate with fix-security-vulnerabilities-with-strix and re-run to prove each exploit is closed. For ongoing coverage as the app changes, gate pull requests using ci-security-scanning-with-strix.
© usestrix, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in skills/owasp-top-10-testing of usestrix/strix.
Open the folder on GitHubat commit 62b4964
Compare with similar skills
OWASP Top 10 Testing with Strix next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| OWASP Top 10 Testing with Strix this skillusestrix/strix | 67k | — | ~1.6k | Automated safety check: Pass | Apache-2.0 | |
| Code Audit3stoneBrother/code-audit | 892 | 1 repos | ~2.7k | Automated safety check: Pass | None | |
| Wooyun Legacytanweai/wooyun-legacy | 1.8k | — | ~1.9k | Automated safety check: Pass | Custom licence | |
| Client Request Signature Reversalawarexone/Agentic-Bug-Hunter | 5.3k | — | ~4.7k | Automated safety check: Pass | MIT | |
| Insecure Deserialization PlaybookPentesterFlow/agent | 1.4k | — | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Burp Suite Project Parsertrailofbits/skills | 7.4k | 3 repos | ~4.2k | Automated safety check: Notes | CC-BY-SA-4.0 |
Similar skills
Wooyun Legacy
tanweai/wooyun-legacy
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…
Client Request Signature Reversal
awarexone/Agentic-Bug-Hunter
Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.
Insecure Deserialization Playbook
PentesterFlow/agent
Fingerprints which language or framework produced a serialized blob, then helps build a working gadget chain to test for insecure deserialization.
- Official
Burp Suite Project Parser
trailofbits/skills
Searches and extracts data from Burp Suite project files on the command line: regex searches over responses, audit findings, proxy history and site map data.
Builtin Agent Skill
samugit83/redamon
Adding a built-in Agent Skill (an attack technique like ssrf, xxe, rce) that ships hardcoded in RedAmon: classified by the Intent Router, injected into the agent prompt, toggled per project, badged…
More from usestrix/strix
Strix Code Vulnerability Scan
usestrix/strix
Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.
Fix Strix Security Findings
usestrix/strix
Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.
Strix Application Security Testing
usestrix/strix
Routes a whole-product security request to the right Strix test per asset, source code, a live app, an API or a CI pipeline, then turns results into one ranked remediation plan.
Related
Categories
Questions about OWASP Top 10 Testing with Strix
What does OWASP Top 10 Testing with Strix do?
Runs Strix's autonomous exploit agents against each OWASP Top 10:2025 category and the API Security Top 10, reporting only what could actually be proven with a proof-of-concept. The skill treats OWASP Top 10 testing as exercising each risk category against the real application rather than running a checklist, and defaults to the 2025 edition, asking the user before testing against the older 2021 edition since a report labeled with the wrong edition is misleading. It names what changed between editions: SSRF folded into A01, A03 Software Supply Chain Failures expanding the old outdated-components category, and a new A10 for mishandling exceptional conditions.
When should I use OWASP Top 10 Testing with Strix?
OWASP Top 10 Testing with Strix fits situations like: running an OWASP Top 10 compliance assessment against a live application; checking an app for SSRF, IDOR or privilege escalation with proof-of-concept exploits; testing against the OWASP API Security Top 10.
How do I install OWASP Top 10 Testing with Strix in Claude Code?
Run `npx skills add usestrix/strix --skill owasp-top-10-testing -a claude-code`. Or copy the skill folder (skills/owasp-top-10-testing in usestrix/strix) into .claude/skills/owasp-top-10-testing in your project. Claude Code loads it when a task matches its description.
How do I install OWASP Top 10 Testing with Strix in Codex?
Run `npx skills add usestrix/strix --skill owasp-top-10-testing -a codex`. Or copy the skill folder (skills/owasp-top-10-testing in usestrix/strix) into .agents/skills/owasp-top-10-testing in your project. Codex loads it when a task matches its description.
Can I use OWASP Top 10 Testing with Strix in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add usestrix/strix --skill owasp-top-10-testing -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/owasp-top-10-testing, .gemini/skills/owasp-top-10-testing, .github/skills/owasp-top-10-testing and .opencode/skills/owasp-top-10-testing in your project.
What does OWASP Top 10 Testing with Strix need to run?
SKILL.md names no scripts, command-line tools or credentials: OWASP Top 10 Testing with Strix is instructions for the agent only. Our summary lists: The Strix CLI; Docker and an LLM key, or Strix's managed cloud platform.
Does OWASP Top 10 Testing with Strix access the network?
SKILL.md names 2 domains. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. As links in the text: owasp.org. This is read from the text; nothing was executed.
Is OWASP Top 10 Testing with Strix safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does OWASP Top 10 Testing with Strix use?
OWASP Top 10 Testing with Strix is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does OWASP Top 10 Testing with Strix use?
About 1.6k tokens (SKILL.md is roughly 6.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to OWASP Top 10 Testing with Strix?
Skills that share tags, products or a category with OWASP Top 10 Testing with Strix: Code Audit (3stoneBrother/code-audit, 892 stars), Wooyun Legacy (tanweai/wooyun-legacy, 1.8k stars), Client Request Signature Reversal (awarexone/Agentic-Bug-Hunter, 5.3k stars) and Insecure Deserialization Playbook (PentesterFlow/agent, 1.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains OWASP Top 10 Testing with Strix?
usestrix (a GitHub organization) maintains it in usestrix/strix, which has 67,388 GitHub stars. The repository holds 4 skills in this directory. The repository was last updated on October 8, 2026.
Source: usestrix/strix on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.