[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M785QNETYHDCDXFE8AV3KFH9":3,"skill-same:01M785QNETYHDCDXFE8AV3KFH9":48},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":14,"repositoryHtmlUrl":30,"repositoryHomepageUrl":6,"ownerHtmlUrl":31,"ownerBlogUrl":6,"ownerDescription":32,"updatedAt":33,"install":34,"resources":47},"01M785QNETYHDCDXFE8AV3KFH9","web-app-penetration-testing",null,"Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.","freeforall1932-design\u002Fskills-repo","freeforall1932-design","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F300004558?v=4","01M7857WA4YZEAY92CZK81AS79","free for all","01M7857WAYPXNBAZFGX3FYT8FD",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fweb-app-penetration-testing\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: web-app-penetration-testing\ndescription: Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.\nlicense: Apache-2.0\nmetadata:\n  author: usestrix\n  homepage: https:\u002F\u002Fdocs.strix.ai\n---\n\n# Pentest a web application\n\nBlack-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage.\n\nInstall, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the **penetration-testing-with-strix** skill — read it if the target is not a running web app, or if `strix --version` fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). This skill is the web-app-specific workflow.\n\n## 1. Confirm authorization and scope\n\nBefore running anything, establish:\n\n- **The target is the user's** (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch.\n- **Which environment.** Prefer staging over production; agents send real exploit payloads and will create\u002Fmodify data.\n- **Out-of-scope paths** — payment flows, mass-email endpoints, admin destructive actions, third-party SSO providers.\n- **Credentials.** Most real vulnerabilities live behind login. Without a test account, the agents only ever see the marketing surface.\n\nAsk for anything missing rather than guessing.\n\n## 2. Run the scan\n\n```bash\nstrix -n -t https:\u002F\u002Fstaging.example.com --max-budget 20 \\\n  --instruction \"Test account: qa@example.com \u002F \u003Cpassword>. In scope: \u002Fapp\u002F*, \u002Fapi\u002F*. Do not touch \u002Fbilling or send email. Focus on access control between the two seeded orgs.\"\n```\n\nNotes that matter for web apps specifically:\n\n- **Give it credentials via `--instruction`** (or `--instruction-file` for anything long), including how to log in if the flow is unusual (magic link, SSO, MFA-exempt test user).\n- **Two accounts beat one.** Multi-tenant IDOR and broken-access-control bugs — consistently the highest-impact class in web apps — can only be proven when the agent can attempt cross-account access.\n- **Add the repo for white-box depth** when you have the source: `-t https:\u002F\u002Fgithub.com\u002Forg\u002Fapp -t https:\u002F\u002Fstaging.example.com` (or a local path). Source access materially improves coverage of business-logic and authorization flaws.\n- **Localhost works.** Point at `http:\u002F\u002Fhost.docker.internal:3000` (Docker Desktop) so the sandbox can reach a dev server on the host.\n- `--scan-mode quick` for a fast dev-loop pass, `standard` (~30 min) for a normal review, `deep` for pre-release assurance. Always set `--max-budget`.\n\nFor a hosted run with no Docker\u002FLLM key, or when the user wants a shareable dashboard and an auditor-ready PDF, use the cloud path in **managed-pentesting-with-strix** instead — same engine, same findings.\n\n## 3. Review results\n\nRead `strix_runs\u002F\u003Crun>\u002Fpenetration_test_report.md` first, then per-finding files in `vulnerabilities\u002F`. Each contains the PoC — re-run it yourself to confirm before reporting to the user.\n\nExit codes: `0` no validated vulns in what was analyzed, `2` vulnerabilities found, `1` fatal error. A `0` is not proof of full coverage — if the budget or turn cap was hit the scan wraps up early, so check `run.json` status and cost against `--max-budget` before calling the app clean.\n\n## 4. Fix and verify\n\nHand findings to the **fix-security-vulnerabilities-with-strix** skill: patch the root cause, then re-run Strix against the same target to prove the exploit no longer works. Re-testing is the only reliable confirmation a fix landed.\n\nTo keep the app tested on every change rather than once, wire Strix into CI with **ci-security-scanning-with-strix**.\n","# Pentest a web application\n\nBlack-box (and optionally source-assisted) penetration testing of a running web app with Strix's autonomous agents. Every reported finding is validated with a working exploit, so there are no signature-based false positives to triage.\n\nInstall, LLM setup, all CLI flags, and the managed-cloud alternative are covered in the **penetration-testing-with-strix** skill — read it if the target is not a running web app, or if `strix --version` fails. For a run with no Docker and no LLM key, the same binary drives the managed platform: `strix cloud login`, then `strix cloud scans start ...` (details in **managed-pentesting-with-strix**). This skill is the web-app-specific workflow.\n\n## 1. Confirm authorization and scope\n\nBefore running anything, establish:\n\n- **The target is the user's** (or they are explicitly authorized to test it). Never pentest a third-party site on a hunch.\n- **Which environment.** Prefer staging over production; agents send real exploit payloads and will create\u002Fmodify data.\n- **Out-of-scope paths** — payment flows, mass-email endpoints, admin destructive actions, third-party SSO providers.\n- **Credentials.** Most real vulnerabilities live behind login. Without a test account, the agents only ever see the marketing surface.\n\nAsk for anything missing rather than guessing.\n\n## 2. Run the scan\n\n```bash\nstrix -n -t https:\u002F\u002Fstaging.example.com --max-budget 20 \\\n  --instruction \"Test account: qa@example.com \u002F \u003Cpassword>. In scope: \u002Fapp\u002F*, \u002Fapi\u002F*. Do not touch \u002Fbilling or send email. Focus on access control between the two seeded orgs.\"\n```\n\nNotes that matter for web apps specifically:\n\n- **Give it credentials via `--instruction`** (or `--instruction-file` for anything long), including how to log in if the flow is unusual (magic link, SSO, MFA-exempt test user).\n- **Two accounts beat one.** Multi-tenant IDOR and broken-access-control bugs — consistently the highest-impact class in web apps — can only be proven when the agent can attempt cross-account access.\n- **Add the repo for white-box depth** when you have the source: `-t https:\u002F\u002Fgithub.com\u002Forg\u002Fapp -t https:\u002F\u002Fstaging.example.com` (or a local path). Source access materially improves coverage of business-logic and authorization flaws.\n- **Localhost works.** Point at `http:\u002F\u002Fhost.docker.internal:3000` (Docker Desktop) so the sandbox can reach a dev server on the host.\n- `--scan-mode quick` for a fast dev-loop pass, `standard` (~30 min) for a normal review, `deep` for pre-release assurance. Always set `--max-budget`.\n\nFor a hosted run with no Docker\u002FLLM key, or when the user wants a shareable dashboard and an auditor-ready PDF, use the cloud path in **managed-pentesting-with-strix** instead — same engine, same findings.\n\n## 3. Review results\n\nRead `strix_runs\u002F\u003Crun>\u002Fpenetration_test_report.md` first, then per-finding files in `vulnerabilities\u002F`. Each contains the PoC — re-run it yourself to confirm before reporting to the user.\n\nExit codes: `0` no validated vulns in what was analyzed, `2` vulnerabilities found, `1` fatal error. A `0` is not proof of full coverage — if the budget or turn cap was hit the scan wraps up early, so check `run.json` status and cost against `--max-budget` before calling the app clean.\n\n## 4. Fix and verify\n\nHand findings to the **fix-security-vulnerabilities-with-strix** skill: patch the root cause, then re-run Strix against the same target to prove the exploit no longer works. Re-testing is the only reliable confirmation a fix landed.\n\nTo keep the app tested on every change rather than once, wire Strix into CI with **ci-security-scanning-with-strix**.\n",{"name":5,"license":15,"metadata":24,"description":7},{"author":25,"homepage":26},"usestrix","https:\u002F\u002Fdocs.strix.ai","main","fd69413366e5700923cdaf27e816a6342375913e","one-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fweb-app-penetration-testing","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design","shipping product noone need or known for myself feel free to use it if useful","2026-11-02 13:54:04",{"source":8,"skillName":5,"commands":35,"prompt":45,"zipAvailable":46},[36,39,42],{"tool":37,"command":38},"npx","npx skills add freeforall1932-design\u002Fskills-repo --skill web-app-penetration-testing",{"tool":40,"command":41},"bunx","bunx skills add freeforall1932-design\u002Fskills-repo --skill web-app-penetration-testing",{"tool":43,"command":44},"pnpm","pnpm dlx skills add freeforall1932-design\u002Fskills-repo --skill web-app-penetration-testing","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fweb-app-penetration-testing\u002FSKILL.md",true,[],[49,56,63,70,77,84],{"skillNo":50,"name":51,"nameZh":6,"description":52,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":19},"01M785QFE2RMXMRHPHE0R7M3YW","penetration-testing-with-strix","Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth\u002Faccess-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fpenetration-testing-with-strix\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":19},"01M785Q8Y2VM6W3KJ5QK5P6VF6","owasp-top-10-testing","Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fowasp-top-10-testing\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":67,"categories":68,"keywords":69,"publishedAt":19},"01M785Q24K39ZEYMXENVAYKPME","managed-pentesting-with-strix","Run a managed pentest of a web app, API, repository, or local workspace on the app.strix.ai platform with the `strix cloud` CLI or REST API — no local Docker or LLM key needed. Safely review and upload local source, register assets, launch and poll scans, triage vulnerabilities, export SARIF, download compliance reports, start PR reviews, buy credits, and set up schedules or webhooks. Use for managed, continuous, scheduled, team-tracked, or sandboxed-agent security testing.","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fmanaged-pentesting-with-strix\u002FSKILL.md",[],[],{"skillNo":71,"name":72,"nameZh":6,"description":73,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":74,"categories":75,"keywords":76,"publishedAt":19},"01M785PW8EPMNN5SH43RVGHFFE","fix-security-vulnerabilities-with-strix","Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Ffix-security-vulnerabilities-with-strix\u002FSKILL.md",[],[],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":19},"01M785PP7C1N489KVZYX002FEM","find-security-vulnerabilities-in-code","Find security vulnerabilities in a codebase or repository with Strix — a white-box AI security review that reads your source, reasons about the actual data flow and authorization model, then exploits what it finds in a live sandbox so every reported issue has a working proof-of-concept instead of a noisy static-analysis alert. Covers injection, XSS, SSRF, broken access control and IDOR, insecure deserialization, secrets in code, unsafe dependencies, and business-logic flaws. Use when the user asks to security-scan, security-review, or audit their code, repo, or pull request for vulnerabilities.","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Ffind-security-vulnerabilities-in-code\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M785PF3ZZSH3H7WVRM642XP2","ci-security-scanning-with-strix","Add security scanning to CI\u002FCD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI pentest that blocks vulnerable code before it merges, with results as PR comments and SARIF uploaded to code scanning. Covers both the self-hosted open-source CLI (runs in your runner) and the managed app.strix.ai platform (GitHub\u002FGitLab app or API, no runner infra). Use when the user asks to add security scanning, SAST\u002FDAST, pentesting, vulnerability checks, or automated security review to their CI pipeline, pre-merge gate, or PR workflow.","https:\u002F\u002Fgithub.com\u002Ffreeforall1932-design\u002Fskills-repo\u002Fblob\u002Fmain\u002Fone-skill\u002Fupstream\u002Fstrix\u002Fskills\u002Fci-security-scanning-with-strix\u002FSKILL.md",[],[]]