running-dynamic-exploitation-with-strix SKILL.md skillB
running-dynamic-exploitation-with-strix from thameema/memnos is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add thameema/memnos/running-dynamic-exploitation-with-strix@git:20261105.034d2b0Pins git:20261105.034d2b0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- thameema/memnos
- Path
plugins/tommy-pentest/skills/running-dynamic-exploitation-with-strix/SKILL.md- Versions recorded
- 1
- Latest version
- git:20261105.034d2b0, committed Nov 5, 2026
- Size
- 7,124 bytes
- Repository stars
- 5
- License
- Apache-2.0
Run a dynamic, active-exploitation pentest with the self-hosted Strix CLI (usestrix/strix, Apache-2.0) — autonomous AI agents that don't just flag vulnerabilities but attempt real exploits (XSS, SSRF, IDOR, auth/access-control flaws, JWT attacks, business logic, race conditions) and only report findings backed by a working proof-of-concept. Closes the gap the passive skills in this pack (headers, TLS, CORS, SAST, secrets) can't: pattern-matching is not proof of exploitability. Self-hosted OSS…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Running Dynamic Exploitation with Strix Strix runs autonomous AI pentesting agents in a Docker sandbox that actively exploit a target — not static analysis. It only reports a finding once it has a working proof-of-concept, which is the one class of result nothing else in this pack can produce: the static/SAST skills here detect *patterns*; Strix proves *exploitability*. > This skill performs ACTIVE exploitation against a live target. It runs only > after `confirming-pentest-authorization` has passed AND the operator has > explicitly named the target as in scope. See **Safety rules** before any > other step. Stop and refuse if the gate is unmet. ## Scope (read before installing anything) Strix ships two ways to run: a **self-hosted open-source CLI** (local Docker sandbox, your own LLM key, nothing leaves your machine) and a **managed cloud** (`app.strix.ai` / `strix cloud ...`), which uploads source code to Strix's infrastructure and has an agent-payable Stripe top-up flow for credits. **This skill covers the self-hosted OSS CLI only, and the cloud path is technically blocked, not just discouraged.** This skill's `disallowed-tools` …
Read the whole file at its exact version.
How to install
mdr add thameema/memnos/running-dynamic-exploitation-with-strix@sha256:4299e64a545d01f3The line at the top of this page pins the label git:20261105.034d2b0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_hmhmdqn3vjpn7e7b)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Nov 5, 2026.
Audit of the latest version
- fail: No curl or wget piped into a shell (matched: curl -sSL https://strix.ai/install | bash)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7124 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
thameema/memnos · 5 stars · license Apache-2.0 · pushed 2026-11-05 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_hmhmdqn3vjpn7e7b GET https://markdownregistry.com/api/v1/resolve?ref=thameema/memnos/running-dynamic-exploitation-with-strix GET https://markdownregistry.com/api/v1/blob/4299e64a545d01f37c126e18e4c9e55d97df6e852de62f051ef000f70a544070
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.