01
It starts by itself
Strix scan reports findings. Runs in GitHub Actions or Claude Code routine.
- ↻ Strix scan reports findings
new strix_runs/<run-name>/vulnerabilities.json or cloud scan with findings
usestrix · 15K installsFix Security Vulnerabilities with Strix skill
Runs by itself, Strix scan reports findings.
Findings fixed and proven closed.
Install the Fix Security Vulnerabilities with Strix skill and make it a habit: follow https://gethabit.dev/skills/usestrix/fix-security-vulnerabilities-with-strix.md
- 1Copy
- 2Paste into Claude Code, Codex or Cursor
- 3It runs by itself
15K installs71K starsApache-2.0 licenceSource on GitHub ↗
Fix Security Vulnerabilities with Strix
by usestrix · 15K installs
The skill
The fix security vulnerabilities with strix skill helps your agent patch findings from a Strix pentest at the root cause and re-run Strix to prove each fix works.
Only when you ask.
The habit
Findings fixed and proven closed.
↻ Runs by itselfStrix scan reports findings
How the habit works.
You don't have to.
When does it start? How does it check its work? What does it remember?
One run, step by step.
Then it stops.
Stops after 5 findings per run and 2 re-scan retries per finding.
- 01
Collect findings
Your agent reads vulnerabilities.json in strix_runs, or pulls cloud findings with strix cloud vulns list.
- 02
Triage
It orders the findings from critical to low and treats each as real until the PoC is re-tested.
- 03
Reproduce
It replays the PoC from the finding file when that is feasible.
- 04
Fix the root cause
It applies a small fix that uses the framework's built-in defense and the repo's patterns.
- 05
Re-scan
It re-runs strix with --scope-mode diff or a focused --instruction, or reruns the cloud scan.
- 06
Run tests
It runs the project's own test suite to catch broken behavior.
- 07
Report
It writes severity, root cause, fix location and result per finding, and marks verified cloud findings fixed.
What it may do.
Nothing more.
It writes only in its own folder and asks you before anything goes out.
- Writes only insrc/**, loops/strix-fix-verify-loop/**
- Talks toapp.strix.ai
- Sendsnothing
- Your OKNothing goes out, so it needs no OK.
Is it for you?
Use it when it fits.
Read both lists. If the left one sounds like you, the Fix Security Vulnerabilities with Strix skill helps.
Use it when
- ✓ A Strix scan reported findings
- ✓ You fix injection, XSS or IDOR issues
- ✓ You need proof a fix closes the exploit
Skip it when
- – You have no Strix scan results
- – You only want a scan, not fixes
Fix Security Vulnerabilities with Strix skill, answered.
Can I trust an exit code of 0?
Only after run.json shows the run completed. The skill also prefers re-running the PoC as the ground truth.
What about leaked secrets?
The fix is to rotate the secret and remove it from code and history. The report says rotation is needed and never shows the secret.
How do I install the Fix Security Vulnerabilities with Strix skill?
Copy the prompt at the top into your agent. It installs the skill from usestrix/strix and sets up the habit. Or run npx skills add usestrix/strix --skill fix-security-vulnerabilities-with-strix.
Is the Fix Security Vulnerabilities with Strix skill free?
Yes. It is published under Apache-2.0. Habit is free too.
Fix Security Vulnerabilities with Strix. Now as a habit.
Install the Fix Security Vulnerabilities with Strix skill and make it a habit: follow https://gethabit.dev/skills/usestrix/fix-security-vulnerabilities-with-strix.md
All usestrix skills →More code skills →
Works in
- Claude Code
- Codex
- Cursor
- ChatGPT
- Claude app
Made by usestrix, published under Apache-2.0. Habit links to the original and never changes it. Is this your skill?