Web App Penetration Testing
Pentest a web app or website end to end : black-box testing of a live URL.
Works in any agent
2 static scans, 0 counted findings.
Recorded for this package revision; Edge checks the exact bundle again when your agent loads it.
What this skill does for you
Pentest a web app or website end to end : black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.
Quoted from the skill description in the pinned sourceUse it with Edge
Set up Edge for me: read getedge.cc/SKILL.md and follow it. Then use Edge to load the web-app-penetration-testing skill from usestrix/strix.
Paste it into Claude, ChatGPT, Codex or Cursor.
Or read the skill source first.
Security evidence
| Scanner | Date | Result | Findings |
|---|---|---|---|
| Edge static checks | 2026-09-29 | Pass | 0 |
| Edge committed-secret checks | 2026-09-29 | Pass | 0 |
Static scans check the code, not how well the skill works.
Scanner scope, raw findings and mirrored provider records
Edge static checks (Edge-run): edge-static/1.0.0. Scope: Static patterns for remote execution, credentials with network sends, obfuscation, prompt overrides, hidden Unicode, binaries and persistence. Revision: 0c702723aa4adf2d388b7218510a6207676bb2e0. Raw findings: not supplied. Counted findings: .
Edge committed-secret checks (Edge-run): edge-secrets/1.0.0. Scope: Credentials committed in the skill's files (values never shown). Revision: 0c702723aa4adf2d388b7218510a6207676bb2e0. Raw findings: not supplied. Counted findings: .
Socket (skills.sh mirror): Version unavailable. Scope: Not supplied by the mirrored record. Revision: not supplied. Raw findings: not supplied. Counted findings: Not supplied.
Snyk (skills.sh mirror): Version unavailable. Scope: Not supplied by the mirrored record. Revision: not supplied. Raw findings: not supplied. Counted findings: Not supplied.
Source and licence
- Repository
- https://github.com/usestrix/strix
- Pinned skill file
- View source at revision
- Revision
- 0c702723aa4adf2d388b7218510a6207676bb2e0
- Package hash
- sha256:a06e2dd962ea1c20ae7ec91484e1c5e60d949b9b26da3ef8f2acd8cc14552365
- Licence
- Apache-2.0
Files in the scanned package
| File | Size |
|---|---|
| SKILL.md | 4.2 KB |
Try Web App Penetration Testing in your agent.
Pentest a web app or website end to end : black-box testing of a live URL.