Is usestrix/strix safe?
https://github.com/usestrix/strix
Strix is a legitimate, well-maintained open-source AI-powered autonomous pentesting tool (Apache 2.0, usestrix organization) with a clean repository, no prompt-injection tricks, and no hidden malicious code. The primary risk factors are the curl-pipe-to-bash install pattern documented in SKILL.md (supply-chain RCE exposure if strix.ai is compromised), built-in telemetry to PostHog and Scarf.sh, and the inherent dual-use nature of a tool that performs live exploitation and PoC validation which an agent could misuse against unauthorized targets. The honeypot credential files were accessed five seconds before the git clone — consistent with audit infrastructure setup rather than skill-triggered behavior — and all canary files remained intact with no network exfiltration detected.
Category Scores
Findings (7)
HIGH curl-pipe-to-bash install pattern in SKILL.md -18 ▶
Both strix-pentest/SKILL.md and strix-ci-setup/SKILL.md instruct the agent and user to install Strix via 'curl -sSL https://strix.ai/install | bash'. This is a supply-chain RCE vector: if strix.ai's DNS, TLS certificate, or CDN infrastructure is compromised, arbitrary code executes on the host with the user's privileges. Because this is the documented canonical install path, an agent following the skill may perform this automatically without additional user confirmation.
MEDIUM Built-in telemetry to PostHog and Scarf.sh -15 ▶
The repository ships strix/telemetry/posthog.py and strix/telemetry/scarf.py, implementing opt-in-by-default usage telemetry. These modules send product analytics events to PostHog and Scarf.sh, third-party data processors. During agent-driven scans, this may leak metadata about scan targets, frequency of use, and feature invocations to parties outside the user's control.
MEDIUM Cloud API transmits targets, credentials, and findings to Strix servers -10 ▶
The strix-cloud-api SKILL.md guides agents to POST scan targets (domain UUIDs, repository UUIDs, internal targets), optional scan credentials including TOTP secrets, focus instructions, and context to https://app.strix.ai/api/v1. All discovered vulnerabilities including PoC scripts are stored on Strix's cloud infrastructure. The agent is instructed to retrieve SARIF and PDF reports from these servers.
MEDIUM Canary credential files accessed before git clone — likely infrastructure artifact -15 ▶
Six honeypot credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, .gcloud/credentials) were opened and read at 16:19:13. The git clone of this repository started at 16:19:18, five seconds later, making it impossible for any Strix code to have triggered these reads. Sequential inode numbers (272633–272638) and the pre-clone timing strongly indicate the oathe audit infrastructure itself accessed these files during environment setup. Canary integrity was confirmed intact by Oathe and no corresponding outbound network exfiltration was detected.
LOW Dual-use autonomous exploitation tool — authorization unverifiable by agent -10 ▶
Strix autonomously discovers and validates vulnerabilities with working PoC exploits. The SKILL.md includes a safety clause requiring user authorization, but an agent has no technical mechanism to verify that the user actually owns or is authorized to test the specified target. An agent following the strix-pentest skill against a third-party target would perform an illegal intrusion test.
LOW SKILL.md references live external documentation URLs -5 ▶
The SKILL.md files reference https://docs.strix.ai and https://docs.app.strix.ai as documentation sources and instruct the agent to follow them for full endpoint references. If these domains were hijacked or if the documentation sites were compromised, adversarial instructions embedded in the documentation pages could influence agent behavior at runtime.
INFO Clean repository structure — no hooks, submodules, or symlinks 0 ▶
The repository contains no git hooks, no .gitattributes filter drivers, no git submodules, and no symlinks pointing outside the repository root. The .pre-commit-config.yaml configures developer-side linting (ruff, mypy, bandit) that runs only on git commit, not during installation or import.