managed-pentesting-with-strix

SKILL.md

Strix Cloud (managed, no local infra)

Use this when you want Strix's autonomous pentesting without running Docker or an LLM yourself — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the penetration-testing-with-strix skill instead — both share the same engine and SARIF output, so you can mix them.

There are two equivalent interfaces. Prefer the CLI:

strix cloud CLI — every REST operation has a command in the form strix cloud <resource> <verb>. Install with curl -sSL https://strix.ai/install | bash. Run strix cloud to list all resources and strix cloud <resource> help (or -h) to list a resource's verbs; a bare resource with a safe read operation runs its documented default.

REST API — base URL https://app.strix.ai/api/v1, Authorization: Bearer <token> on every request. Full reference: docs.app.strix.ai · agent index: https://docs.app.strix.ai/llms.txt · OpenAPI: https://docs.app.strix.ai/openapi.json.

The CLI is equally usable by agents and people. Output is complete JSON when stdout is not a terminal, or when you pass --json; terminal tables favor names, branches, lifecycle states, and numbered selectors. Human lists retain the selectors needed by follow-up commands but omit internal organization/user IDs; a selector too long for the compact table is repeated losslessly in a copyable block. Paginated lists print the next --page or --offset, and detail views preserve useful prose within a safe terminal bound; use --json for the complete record. Token lists label credentials as active, expired, or revoked. Binary downloads are the exception: redirect raw bytes intentionally, or use --output FILE --json to write the file and receive structured metadata. There are no interactive prompts when stdin is not a terminal. Exit codes: 0 success, 1 request/runtime error, 2 invalid usage, 4 authentication or plan limit, 5 payment required.

Every resource group with a safe read operation has a useful default action, and -h or help always shows its verbs. Native tab completion includes resources, verbs, flags, workspace commands, and local paths:

source <(strix completions zsh)       # current zsh session
source <(strix completions bash)      # current bash session
strix completions fish | source       # current fish session