feat: Add prompt module collections and contributing.md (#40)

strix/agents/StrixAgent/system_prompt.jinja

@@ -248,7 +248,7 @@ CRITICAL RULES:
 - **ONE AGENT = ONE TASK** - Don't let agents do multiple unrelated jobs
 - **SPAWN REACTIVELY** - Create new agents based on what you discover
 - **ONLY REPORTING AGENTS** can use create_vulnerability_report tool
-- **AGENT SPECIALIZATION MANDATORY** - Each agent must be highly specialized with maximum 3 prompt modules
+- **AGENT SPECIALIZATION MANDATORY** - Each agent must be highly specialized; prefer 1–3 prompt modules, up to 5 for complex contexts
 - **NO GENERIC AGENTS** - Avoid creating broad, multi-purpose agents that dilute focus
 
 AGENT SPECIALIZATION EXAMPLES:
@@ -262,7 +262,7 @@ GOOD SPECIALIZATION:
 BAD SPECIALIZATION:
 - "General Web Testing Agent" with prompt_modules: sql_injection, xss, csrf, ssrf, authentication_jwt (too broad)
 - "Everything Agent" with prompt_modules: all available modules (completely unfocused)
-- Any agent with more than 3 prompt modules (violates constraints)
+- Any agent with more than 5 prompt modules (violates constraints)
 
 FOCUS PRINCIPLES:
 - Each agent should have deep expertise in 1-3 related vulnerability types

strix/cli/app.py

@@ -7,7 +7,7 @@ import signal
 import sys
 import threading
 from collections.abc import Callable
-from typing import Any, ClassVar
+from typing import Any, ClassVar, cast
 
 from rich.markup import escape as rich_escape
 from rich.text import Text
@@ -26,7 +26,7 @@ from strix.llm.config import LLMConfig
 
 
 def escape_markup(text: str) -> str:
-    return rich_escape(text)
+    return cast("str", rich_escape(text))
 
 
 class ChatTextArea(TextArea):  # type: ignore[misc]

strix/cli/main.py

@@ -139,7 +139,8 @@ def validate_environment() -> None:
                     )
                 elif var == "LLM_API_BASE":
                     error_text.append(
-                        "export LLM_API_BASE='http://localhost:11434'  # needed for local models only\n",
+                        "export LLM_API_BASE='http://localhost:11434'  "
+                        "# needed for local models only\n",
                         style="dim white",
                     )
                 elif var == "PERPLEXITY_API_KEY":

strix/cli/tool_components/base_renderer.py

@@ -1,5 +1,5 @@
 from abc import ABC, abstractmethod
-from typing import Any, ClassVar
+from typing import Any, ClassVar, cast
 
 from rich.markup import escape as rich_escape
 from textual.widgets import Static
@@ -17,7 +17,7 @@ class BaseToolRenderer(ABC):
 
     @classmethod
     def escape_markup(cls, text: str) -> str:
-        return rich_escape(text)
+        return cast("str", rich_escape(text))
 
     @classmethod
     def format_args(cls, args: dict[str, Any], max_length: int = 500) -> str:

strix/cli/tool_components/reporting_renderer.py

@@ -27,7 +27,8 @@ class CreateVulnerabilityReportRenderer(BaseToolRenderer):
             if severity:
                 severity_color = cls._get_severity_color(severity.lower())
                 content_parts.append(
-                    f"  [dim]Severity: [{severity_color}]{cls.escape_markup(severity.upper())}[/{severity_color}][/]"
+                    f"  [dim]Severity: [{severity_color}]"
+                    f"{cls.escape_markup(severity.upper())}[/{severity_color}][/]"
                 )
 
             if content:

strix/prompts/README.md

@@ -0,0 +1,64 @@
+# 📚 Strix Prompt Modules
+
+## 🎯 Overview
+
+Prompt modules are specialized knowledge packages that enhance Strix agents with deep expertise in specific vulnerability types, technologies, and testing methodologies. Each module provides advanced techniques, practical examples, and validation methods that go beyond baseline security knowledge.
+
+---
+
+## 🏗️ Architecture
+
+### How Prompts Work
+
+When an agent is created, it can load up to 5 specialized prompt modules relevant to the specific subtask and context at hand:
+
+```python
+# Agent creation with specialized modules
+create_agent(
+    task="Test authentication mechanisms in API",
+    name="Auth Specialist",
+    prompt_modules="authentication_jwt,business_logic"
+)
+```
+
+The modules are dynamically injected into the agent's system prompt, allowing it to operate with deep expertise tailored to the specific vulnerability types or technologies required for the task at hand.
+
+---
+
+## 📁 Module Categories
+
+| Category | Purpose |
+|----------|---------|
+| **`/vulnerabilities`** | Advanced testing techniques for core vulnerability classes like authentication bypasses, business logic flaws, and race conditions |
+| **`/frameworks`** | Specific testing methods for popular frameworks e.g. Django, Express, FastAPI, and Next.js |
+| **`/technologies`** | Specialized techniques for third-party services such as Supabase, Firebase, Auth0, and payment gateways |
+| **`/protocols`** | Protocol-specific testing patterns for GraphQL, WebSocket, OAuth, and other communication standards |
+| **`/cloud`** | Cloud provider security testing for AWS, Azure, GCP, and Kubernetes environments |
+| **`/reconnaissance`** | Advanced information gathering and enumeration techniques for comprehensive attack surface mapping |
+| **`/custom`** | Community-contributed modules for specialized or industry-specific testing scenarios |
+
+---
+
+## 🎨 Creating New Modules
+
+### What Should a Module Contain?
+
+A good prompt module is a structured knowledge package that typically includes:
+
+- **Advanced techniques** - Non-obvious methods specific to the task and domain
+- **Practical examples** - Working payloads, commands, or test cases with variations
+- **Validation methods** - How to confirm findings and avoid false positives
+- **Context-specific insights** - Environment and version nuances, configuration-dependent behavior, and edge cases
+
+Modules use XML-style tags for structure and focus on deep, specialized knowledge that significantly enhances agent capabilities for that specific context.
+
+---
+
+## 🤝 Contributing
+
+Community contributions are more than welcome — contribute new modules via [pull requests](https://github.com/usestrix/strix/pulls) or [GitHub issues](https://github.com/usestrix/strix/issues) to help expand the collection and improve extensibility for Strix agents.
+
+---
+
+> [!NOTE]
+> **Work in Progress** - We're actively expanding the prompt module collection with specialized techniques and new categories.

strix/prompts/__init__.py

@@ -58,7 +58,7 @@ def generate_modules_description() -> str:
     modules_str = ", ".join(sorted_modules)
 
     description = (
-        f"List of prompt modules to load for this agent (max 3). Available modules: {modules_str}. "
+        f"List of prompt modules to load for this agent (max 5). Available modules: {modules_str}. "
     )
 
     example_modules = sorted_modules[:2]

strix/tools/agents_graph/agents_graph_actions.py

@@ -199,11 +199,11 @@ def create_agent(
         if prompt_modules:
             module_list = [m.strip() for m in prompt_modules.split(",") if m.strip()]
 
-        if len(module_list) > 3:
+        if len(module_list) > 5:
             return {
                 "success": False,
                 "error": (
-                    "Cannot specify more than 3 prompt modules for an agent "
+                    "Cannot specify more than 5 prompt modules for an agent "
                     "(use comma-separated format)"
                 ),
                 "agent_id": None,

strix/tools/agents_graph/agents_graph_actions_schema.xml

@@ -80,7 +80,7 @@ Only create a new agent if no existing agent is handling the specific task.</des
         <description>Whether the new agent should inherit parent's conversation history and context</description>
       </parameter>
       <parameter name="prompt_modules" type="string" required="false">
-        <description>Comma-separated list of prompt modules to use for the agent (MAXIMUM 3 modules allowed). Most agents should have at least one module in order to be useful. Agents should be highly specialized - use 1-3 related vulnerability modules only. {{DYNAMIC_MODULES_DESCRIPTION}}</description>
+        <description>Comma-separated list of prompt modules to use for the agent (MAXIMUM 5 modules allowed). Most agents should have at least one module in order to be useful. Agents should be highly specialized - use 1-3 related modules; up to 5 for complex contexts. {{DYNAMIC_MODULES_DESCRIPTION}}</description>
       </parameter>
     </parameters>
     <returns type="Dict[str, Any]">
@@ -114,7 +114,7 @@ Only create a new agent if no existing agent is handling the specific task.</des
   <parameter=prompt_modules>xss</parameter>
   </function>
 
-  # Example of maximum 3 related modules (borderline acceptable)
+  # Example of up to 5 related modules (borderline acceptable)
   <function=create_agent>
   <parameter=task>Test for server-side vulnerabilities including SSRF, XXE, and potential
               RCE vectors in file upload and XML processing endpoints.</parameter>

strix/tools/registry.py

@@ -33,7 +33,7 @@ def _process_dynamic_content(content: str) -> str:
             logger.warning("Could not import prompts utilities for dynamic schema generation")
             content = content.replace(
                 "{{DYNAMIC_MODULES_DESCRIPTION}}",
-                "List of prompt modules to load for this agent (max 3). Module discovery failed.",
+                "List of prompt modules to load for this agent (max 5). Module discovery failed.",
             )
 
     return content