Strix

{
  "skill_name": "strix",
  "evals": [
    {
      "id": 1,
      "prompt": "Strix로 우리 로컬 저장소를 빠르게 PR 보안 점검하고 싶어.",
      "expected_output": "The skill installs or verifies Strix, requires Docker, configures STRIX_LLM, and uses headless quick scan syntax.",
      "assertions": [
        "The response includes `strix -n --target ./ --scan-mode quick` or an equivalent quick CI command",
        "The response requires Docker to be available",
        "The response mentions `STRIX_LLM` configuration"
      ]
    },
    {
      "id": 2,
      "prompt": "GitHub 리포지토리랑 스테이징 URL을 같이 넣어서 Strix로 검사하고 싶어.",
      "expected_output": "The skill supports repeated targets and shows a multi-target command with both source and runtime surfaces.",
      "assertions": [
        "The response uses repeated `--target` or `-t` arguments",
        "The response supports both a GitHub repository URL and a live URL in the same workflow"
      ]
    },
    {
      "id": 3,
      "prompt": "인증 필요한 테스트라 계정 정보랑 제외 범위를 Strix에 넘기고 싶어.",
      "expected_output": "The skill recommends `--instruction` or `--instruction-file` and keeps scope explicit.",
      "assertions": [
        "The response mentions `--instruction` or `--instruction-file`",
        "The response treats credentials and exclusions as explicit scoped input"
      ]
    },
    {
      "id": 4,
      "prompt": "GitHub Actions에서 Strix 돌릴 건데 취약점 나오면 실패하게 하고 싶어.",
      "expected_output": "The skill explains CI headless mode, exit codes, and provides a GitHub Actions-friendly command.",
      "assertions": [
        "The response mentions exit code `2` for findings",
        "The response uses headless mode with `-n` or `--non-interactive`",
        "The response is compatible with GitHub Actions or CI runners"
      ]
    },
    {
      "id": 5,
      "prompt": "Strix 내부 skill이랑 여기 jeo-skills의 skill이 같은 개념이야?",
      "expected_output": "The skill clearly distinguishes Strix internal markdown knowledge packs from this repo's agent skills.",
      "assertions": [
        "The response states they are different systems",
        "The response mentions Strix internal skill categories or examples"
      ]
    }
  ]
}

#!/usr/bin/env bash

set -euo pipefail

TARGET="${1:-./}"
MODE="${STRIX_SCAN_MODE:-quick}"

if [[ -z "${STRIX_LLM:-}" ]]; then
  echo "STRIX_LLM must be set in CI." >&2
  exit 1
fi

if ! command -v strix >/dev/null 2>&1; then
  echo "Strix is not installed on this runner." >&2
  exit 1
fi

if ! command -v docker >/dev/null 2>&1 || ! docker info >/dev/null 2>&1; then
  echo "Docker must be available on the CI runner." >&2
  exit 1
fi

exec strix -n --target "$TARGET" --scan-mode "$MODE"

#!/usr/bin/env bash

set -euo pipefail

VERSION_VALUE=""
SKIP_IMAGE=false
SKIP_DOCKER_CHECK=false
STRIX_IMAGE_DEFAULT="${STRIX_IMAGE:-ghcr.io/usestrix/strix-sandbox:0.1.13}"

usage() {
  cat <<'EOF'
Usage: bash scripts/install.sh [options]

Options:
  --version <version>      Install a specific Strix release version
  --skip-image             Skip pulling the sandbox image
  --skip-docker-check      Skip Docker preflight checks
  -h, --help               Show this help
EOF
}

need_cmd() {
  if ! command -v "$1" >/dev/null 2>&1; then
    echo "Missing required command: $1" >&2
    exit 1
  fi
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --version)
      VERSION_VALUE="${2:-}"
      if [[ -z "$VERSION_VALUE" ]]; then
        echo "--version requires a value" >&2
        exit 1
      fi
      shift 2
      ;;
    --skip-image)
      SKIP_IMAGE=true
      shift
      ;;
    --skip-docker-check)
      SKIP_DOCKER_CHECK=true
      shift
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown argument: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
done

need_cmd curl

if ! command -v strix >/dev/null 2>&1; then
  echo "Installing Strix..."
  if [[ -n "$VERSION_VALUE" ]]; then
    env VERSION="$VERSION_VALUE" bash -lc 'curl -sSL https://strix.ai/install | bash'
  else
    bash -lc 'curl -sSL https://strix.ai/install | bash'
  fi
else
  echo "Strix already present on PATH; skipping binary install."
fi

if ! command -v strix >/dev/null 2>&1; then
  echo "Strix installation failed or the binary is not on PATH." >&2
  exit 1
fi

echo "Installed version:"
strix --version || true

if [[ "$SKIP_DOCKER_CHECK" == true ]]; then
  exit 0
fi

need_cmd docker

if ! docker info >/dev/null 2>&1; then
  echo "Docker is installed but the daemon is not running." >&2
  exit 1
fi

if [[ "$SKIP_IMAGE" == false ]]; then
  if docker image inspect "$STRIX_IMAGE_DEFAULT" >/dev/null 2>&1; then
    echo "Sandbox image already present: $STRIX_IMAGE_DEFAULT"
  else
    echo "Pulling sandbox image: $STRIX_IMAGE_DEFAULT"
    docker pull "$STRIX_IMAGE_DEFAULT"
  fi
fi

cat <<'EOF'
Next steps:
  export STRIX_LLM="openai/gpt-5.4"
  export LLM_API_KEY="your-api-key"
  bash scripts/run-scan.sh --target ./app --scan-mode quick --dry-run
EOF

#!/usr/bin/env bash

set -euo pipefail

MODE=""
NON_INTERACTIVE=false
BROWSER_OFF=false
DRY_RUN=false
CONFIG_FILE=""
INSTRUCTION=""
INSTRUCTION_FILE=""
declare -a TARGETS=()
declare -a EXTRA_ARGS=()

usage() {
  cat <<'EOF'
Usage: bash scripts/run-scan.sh --target <target> [options] [-- extra strix args]

Options:
  --target, -t <target>         Add a target. Repeat for multi-target scans.
  --scan-mode, -m <mode>        quick | standard | deep
  --instruction <text>          Inline scope or credential instructions
  --instruction-file <file>     File-based instructions
  --config <file>               Custom Strix config file
  --non-interactive, -n         Headless mode
  --browser-off                 Export STRIX_DISABLE_BROWSER=true for this run
  --dry-run                     Print the command without executing
  -h, --help                    Show this help
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --target|-t)
      TARGETS+=("${2:-}")
      shift 2
      ;;
    --scan-mode|-m)
      MODE="${2:-}"
      shift 2
      ;;
    --instruction)
      INSTRUCTION="${2:-}"
      shift 2
      ;;
    --instruction-file)
      INSTRUCTION_FILE="${2:-}"
      shift 2
      ;;
    --config)
      CONFIG_FILE="${2:-}"
      shift 2
      ;;
    --non-interactive|-n)
      NON_INTERACTIVE=true
      shift
      ;;
    --browser-off)
      BROWSER_OFF=true
      shift
      ;;
    --dry-run)
      DRY_RUN=true
      shift
      ;;
    --)
      shift
      EXTRA_ARGS+=("$@")
      break
      ;;
    -h|--help)
      usage
      exit 0
      ;;
    *)
      echo "Unknown argument: $1" >&2
      usage >&2
      exit 1
      ;;
  esac
done

if ! command -v strix >/dev/null 2>&1; then
  echo "Strix is not installed. Run bash scripts/install.sh first." >&2
  exit 1
fi

if [[ ${#TARGETS[@]} -eq 0 ]]; then
  echo "At least one --target is required." >&2
  exit 1
fi

if ! command -v docker >/dev/null 2>&1 || ! docker info >/dev/null 2>&1; then
  echo "Docker must be available and running before invoking Strix." >&2
  exit 1
fi

if [[ -z "${STRIX_LLM:-}" ]]; then
  echo "Warning: STRIX_LLM is not set. Strix may fail without an explicit model configuration." >&2
fi

declare -a CMD=(strix)

for target in "${TARGETS[@]}"; do
  CMD+=(--target "$target")
done

if [[ -n "$MODE" ]]; then
  CMD+=(--scan-mode "$MODE")
fi

if [[ -n "$INSTRUCTION" ]]; then
  CMD+=(--instruction "$INSTRUCTION")
fi

if [[ -n "$INSTRUCTION_FILE" ]]; then
  CMD+=(--instruction-file "$INSTRUCTION_FILE")
fi

if [[ -n "$CONFIG_FILE" ]]; then
  CMD+=(--config "$CONFIG_FILE")
fi

if [[ "$NON_INTERACTIVE" == true ]]; then
  CMD+=(--non-interactive)
fi

if [[ ${#EXTRA_ARGS[@]} -gt 0 ]]; then
  CMD+=("${EXTRA_ARGS[@]}")
fi

if [[ "$BROWSER_OFF" == true ]]; then
  export STRIX_DISABLE_BROWSER=true
fi

printf 'Running:' >&2
for part in "${CMD[@]}"; do
  printf ' %q' "$part" >&2
done
printf '\n' >&2

if [[ "$DRY_RUN" == true ]]; then
  exit 0
fi

exec "${CMD[@]}"

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Strix Skill Autoresearch</title>
  <style>
    :root {
      color-scheme: light;
      --bg: #f7f3ec;
      --panel: #fffdf9;
      --ink: #1f1f1f;
      --muted: #6c665d;
      --line: #ddd2c2;
      --accent: #0f766e;
      --warn: #a16207;
    }
    body {
      margin: 0;
      font-family: ui-sans-serif, system-ui, sans-serif;
      background: radial-gradient(circle at top, #fffaf1 0%, var(--bg) 60%);
      color: var(--ink);
    }
    main {
      max-width: 960px;
      margin: 0 auto;
      padding: 32px 20px 48px;
    }
    h1, h2 {
      margin: 0 0 12px;
    }
    p {
      color: var(--muted);
    }
    .grid {
      display: grid;
      grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
      gap: 16px;
      margin: 24px 0;
    }
    .card {
      background: var(--panel);
      border: 1px solid var(--line);
      border-radius: 16px;
      padding: 16px;
      box-shadow: 0 10px 30px rgba(31, 31, 31, 0.06);
    }
    table {
      width: 100%;
      border-collapse: collapse;
      background: var(--panel);
      border: 1px solid var(--line);
      border-radius: 16px;
      overflow: hidden;
    }
    th, td {
      text-align: left;
      padding: 12px 14px;
      border-bottom: 1px solid var(--line);
      vertical-align: top;
    }
    th {
      background: #f2eadf;
    }
    .pill {
      display: inline-block;
      border-radius: 999px;
      padding: 4px 10px;
      font-size: 12px;
      font-weight: 700;
    }
    .keep {
      background: rgba(15, 118, 110, 0.12);
      color: var(--accent);
    }
    .baseline {
      background: rgba(161, 98, 7, 0.12);
      color: var(--warn);
    }
    code {
      font-family: ui-monospace, SFMono-Regular, monospace;
    }
  </style>
</head>
<body>
  <main>
    <h1>Strix Skill Autoresearch</h1>
    <p>Baseline versus final mutation log for <code>.agent-skills/strix/SKILL.md</code>.</p>
    <div id="summary" class="grid"></div>
    <h2>Experiments</h2>
    <table>
      <thead>
        <tr>
          <th>Experiment</th>
          <th>Status</th>
          <th>Score</th>
          <th>Description</th>
        </tr>
      </thead>
      <tbody id="rows"></tbody>
    </table>
  </main>
  <script type="application/json" id="fallback-data">
    {
      "skill_name": "strix",
      "status": "complete",
      "updated_at": "2026-03-28T03:15:00Z",
      "experiments": [
        {
          "experiment": 0,
          "score": 5,
          "max_score": 6,
          "pass_rate": 0.8333,
          "status": "baseline",
          "description": "Initial draft emphasized install, targets, and scan modes but only implied CI exit-code behavior and internal-skill separation."
        },
        {
          "experiment": 1,
          "score": 6,
          "max_score": 6,
          "pass_rate": 1.0,
          "status": "keep",
          "description": "Kept mutation: added explicit exit codes, CI framing, and a dedicated internal-skills step with its own reference file."
        }
      ]
    }
  </script>
  <script>
    const fallback = JSON.parse(document.getElementById("fallback-data").textContent);

    async function loadData() {
      try {
        const response = await fetch("results.json", { cache: "no-store" });
        if (!response.ok) throw new Error("Failed to load results.json");
        return await response.json();
      } catch {
        return fallback;
      }
    }

    function metric(label, value) {
      const el = document.createElement("section");
      el.className = "card";
      el.innerHTML = `<strong>${label}</strong><div>${value}</div>`;
      return el;
    }

    function render(data) {
      const summary = document.getElementById("summary");
      const rows = document.getElementById("rows");
      const first = data.experiments[0];
      const last = data.experiments[data.experiments.length - 1];

      summary.append(
        metric("Skill", data.skill_name),
        metric("Status", data.status),
        metric("Baseline", `${first.score}/${first.max_score}`),
        metric("Final", `${last.score}/${last.max_score}`)
      );

      for (const exp of data.experiments) {
        const tr = document.createElement("tr");
        tr.innerHTML = `
          <td>${exp.experiment}</td>
          <td><span class="pill ${exp.status === "keep" ? "keep" : "baseline"}">${exp.status}</span></td>
          <td>${exp.score}/${exp.max_score} (${Math.round(exp.pass_rate * 100)}%)</td>
          <td>${exp.description}</td>
        `;
        rows.appendChild(tr);
      }
    }

    loadData().then(render);
  </script>
</body>
</html>

{
  "skill_name": "strix",
  "status": "complete",
  "updated_at": "2026-03-28T03:15:00Z",
  "evals": [
    {
      "id": "authorized-use",
      "question": "Does the skill restrict Strix usage to authorized targets?"
    },
    {
      "id": "docker-and-provider",
      "question": "Does the skill require Docker and explain provider configuration?"
    },
    {
      "id": "target-coverage",
      "question": "Does the skill cover local paths, GitHub repositories, live URLs, and multi-target scans?"
    },
    {
      "id": "ci-and-exit-codes",
      "question": "Does the skill explain headless CI usage and exit codes 0, 1, and 2?"
    },
    {
      "id": "reference-support",
      "question": "Does the skill point to scripts and detailed references instead of burying everything in one file?"
    },
    {
      "id": "internal-skills-distinction",
      "question": "Does the skill explain that Strix internal skills are different from jeo-skills?"
    }
  ],
  "experiments": [
    {
      "experiment": 0,
      "score": 5,
      "max_score": 6,
      "pass_rate": 0.8333,
      "status": "baseline",
      "description": "Initial draft emphasized install, targets, and scan modes but only implied CI exit-code behavior and internal-skill separation.",
      "kept": true,
      "per_eval": {
        "authorized-use": true,
        "docker-and-provider": true,
        "target-coverage": true,
        "ci-and-exit-codes": false,
        "reference-support": true,
        "internal-skills-distinction": true
      }
    },
    {
      "experiment": 1,
      "score": 6,
      "max_score": 6,
      "pass_rate": 1.0,
      "status": "keep",
      "description": "Kept mutation: added explicit exit codes, CI framing, and a dedicated internal-skills step with its own reference file.",
      "kept": true,
      "per_eval": {
        "authorized-use": true,
        "docker-and-provider": true,
        "target-coverage": true,
        "ci-and-exit-codes": true,
        "reference-support": true,
        "internal-skills-distinction": true
      }
    }
  ]
}

experiment	score	max_score	pass_rate	status	description
0	5	6	0.8333	baseline	Initial draft covered install and execution but under-specified exit-code handling and the distinction between Strix internal skills and jeo-skills.
1	6	6	1.0000	keep	Added explicit exit-code guidance, stronger CI recommendations, and a dedicated step plus reference for Strix internal skills.

---
name: strix
description: >
  Install and use Strix for AI-driven security scans against local projects,
  repositories, and authorized web targets. Use when you need Strix setup, scan
  mode selection, or CI execution guidance. Triggers on: strix, appsec scan,
  vulnerability scan cli, strix ci, ai pentest.
allowed-tools: Bash Read Write Edit Glob Grep WebFetch
compatibility: Requires Docker access and an LLM provider or compatible endpoint.
license: Apache-2.0
metadata:
  tags: strix, appsec, pentest, vulnerability-scan, ci-cd, docker, llm
  version: "0.1-baseline"
  source: https://github.com/usestrix/strix
---

# strix - AI-Driven Application Security Testing

Only use Strix against systems you own or are explicitly authorized to test.

## When to use this skill

- Install Strix and verify Docker access
- Configure a model provider for Strix
- Run scans against local directories, repositories, or URLs
- Use quick, standard, or deep scan modes
- Run Strix in CI

## Instructions

1. Install Strix with `bash scripts/install.sh` or `curl -sSL https://strix.ai/install | bash`
2. Configure `STRIX_LLM` and `LLM_API_KEY`
3. Run `strix --target ./app`
4. Use `--scan-mode quick|standard|deep` as needed
5. Use `-n` for CI/CD
6. Review results in `strix_runs/<run-name>`

## Examples

### Local scan

```bash
strix --target ./app
```

### GitHub repository

```bash
strix --target https://github.com/org/repo
```

### CI scan

```bash
strix -n --target ./ --scan-mode quick
```

## Best practices

1. Keep Docker running before you start.
2. Prefer quick scans in CI.
3. Keep credentials explicit when a target requires authentication.

## References

- [references/commands.md](../references/commands.md)
- [references/providers-and-config.md](../references/providers-and-config.md)

N:strix
D:[strix] Install, configure, and operate Strix for AI-driven application security testing. Covers local directories, GitHub repositories, live URLs, multi-target scans, LLM provider setup, Docker sandbox preflight, scan modes, headless CI/CD, and Strix internal skill awareness.
G:strix appsec pentest vulnerability-scan ci-cd docker llm security-testing bug-bounty browser-automation

U[8]:
  Install Strix and verify Docker plus sandbox readiness
  Configure STRIX_LLM, LLM_API_KEY, LLM_API_BASE, and optional runtime flags
  Run white-box scans against local repos or directories
  Run black-box or grey-box scans against authorized URLs, domains, or IPs
  Pass credentials and scope using --instruction or --instruction-file
  Choose quick, standard, or deep based on speed versus coverage
  Run headless scans in CI/CD and interpret exit codes 0, 1, and 2
  Explain Strix internal skills and how they differ from jeo-skills

S[6]{n,action,details}:
  1,Install,bash scripts/install.sh OR curl -sSL https://strix.ai/install | bash
  2,Configure,export STRIX_LLM=openai/gpt-5.4 && export LLM_API_KEY=your-api-key
  3,Target,choose local path GitHub repo URL live URL domain IP or repeated --target entries
  4,Scan,run strix directly or bash scripts/run-scan.sh with --scan-mode quick|standard|deep
  5,Review,inspect strix_runs/<run-name> and use exit codes 0=no findings 1=error 2=findings
  6,Automate,use -n in CI and prefer quick for pull requests with Docker-enabled runners

R[8]:
  Only test assets you own or are explicitly authorized to assess
  Docker is mandatory for the local CLI workflow and first run may pull the sandbox image
  Use --instruction-file for credentials scope exclusions and rules of engagement
  Default CI scans to quick; reserve standard or deep for scheduled or release gates
  Keep secrets in env vars or CI secrets instead of scattering them inline
  Combine source and live targets when you need better remediation context
  Distinguish this repo's strix skill from Strix internal skills under strix/skills
  Optional flags worth knowing: PERPLEXITY_API_KEY STRIX_DISABLE_BROWSER STRIX_REASONING_EFFORT STRIX_TELEMETRY

E[6]{type,command}:
  Install,bash scripts/install.sh
  Local repo,strix --target ./app --scan-mode standard
  GitHub repo,strix --target https://github.com/org/repo
  Authenticated target,strix --target https://staging.example.com --instruction-file ./instruction.md
  Multi-target,strix -t https://github.com/org/repo -t https://staging.example.com
  CI quick scan,strix -n --target ./ --scan-mode quick