managed-pentesting-with-strixlisted

Run a managed pentest of a web app or API through the app.strix.ai REST API — no local Docker, LLM key, or install needed. Create an API token, register domain/repository assets, launch and poll scans, triage vulnerabilities, export SARIF, download PDF/DOCX pentest reports for SOC 2 and other compliance evidence (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants continuous or scheduled pentesting-as-a-service, an auditor-ready pentest report, scans tracked in a team dashboard, or security testing from a sandboxed agent/CI environment with no infrastructure.
wedabro/bro-skills · ★ 2 · Testing & QA · score 74

Install: claude install-skill wedabro/bro-skills

# Strix Cloud API (managed, no local infra) Use this when you want Strix's autonomous pentesting **without running Docker or an LLM yourself** — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the **penetration-testing-with-strix** skill instead — both share the same engine and SARIF output, so you can mix them. Full reference: **[docs.app.strix.ai](https://docs.app.strix.ai)** · OpenAPI: `https://docs.app.strix.ai/openapi.json` ## Setup - **Base URL:** `https://app.strix.ai/api/v1` - **Auth:** every request sends `Authorization: Bearer <token>`. Tokens are **org-scoped**. - **Get a token:** the user creates one in the dashboard at **Settings → API Access** (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store. - **Scopes (least-privilege):** assign only what the integration needs and rotate regularly: | Scope | Grants | |---|---| | `scans:read` / `scans:write` | list/read/report scans · create/rerun/cancel scans | | `vulnerabilities:read` / `:write` | read findings · update status & notes | | `assets:read` / `:write` | read domains/repos · register/update them | | `schedules:read` / `:write` | read schedu