forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-21 18:52:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs(skills): document --workspace-file for supporting files

Browse Source
This commit is contained in:
Alex Schapiro
2026-08-20 19:27:04 -04:00
committed by alex s
parent 9099710cef
commit d6a3ca7e58
2 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/api-security-testing/SKILL.md
+1
View File
@@ -47,6 +47,7 @@ Out of scope: POST /billing/*, POST /notifications/broadcast."
- **GraphQL:** point at the GraphQL endpoint and say whether introspection is enabled; call out that you want batching/aliasing abuse, depth/complexity limits, and per-field authorization tested.
- **Internal/private APIs** unreachable from your machine: use the managed platform's network connector — see **managed-pentesting-with-strix**.
- Use `--instruction-file` when the credential/context block gets long, and keep tokens out of shell history and out of committed files.
- **Supporting files** the agents should read but not test, such as an endpoint wordlist or handwritten notes about the tenancy model: pass `--workspace-file ./notes.md`. The file lands read-only in `/workspace`. Add `:DEST` to choose the path, for example `--workspace-file ./wordlist.txt:lists/wordlist.txt`.
## 3. Verify findings