Custom Instructions

Use instructions to provide context, credentials, or focus areas for your scan.

Inline Instructions

strix --target https://app.com --instruction "Focus on authentication vulnerabilities"

File-Based Instructions

For complex instructions, use a file:

strix --target https://app.com --instruction-file ./pentest-instructions.md

Common Use Cases

Authenticated Testing

strix --target https://app.com \
  --instruction "Login with email: [email protected], password: TestPass123"

Focused Scope

strix --target https://api.example.com \
  --instruction "Focus on IDOR vulnerabilities in the /api/users endpoints"

Exclusions

strix --target https://app.com \
  --instruction "Do not test /admin or /internal endpoints"

API Testing

strix --target https://api.example.com \
  --instruction "Use API key header: X-API-Key: abc123. Focus on rate limiting bypass."

Instruction File Example

# Penetration Test Instructions

## Credentials
- Admin: [email protected] / AdminPass123
- User: [email protected] / UserPass123

## Focus Areas
1. IDOR in user profile endpoints
2. Privilege escalation between roles
3. JWT token manipulation

## Out of Scope
- /health endpoints
- Third-party integrations

Workspace files

Instructions become part of the prompt. To give Strix a file to work with, such as a wordlist, an API specification, or notes, use --workspace-file. Strix places the file into the sandbox workspace before the scan starts.

strix --target https://app.com --workspace-file ./wordlist.txt

The file lands at /workspace/<file name>. To choose the destination, write PATH:DEST. DEST is a path inside /workspace.

strix --target https://app.com \
  --workspace-file ./openapi.yaml:specs/openapi.yaml \
  --workspace-file ./notes.md

Repeat the option for every file you want to place. Strix lists the files in the agent task, so the agent knows where to read them.

Rules that apply to every workspace file:

• The file is read-only inside the sandbox.
• The destination must stay inside /workspace.
• The destination must not fall inside a target directory, because target files come from the target itself. Strix skips such a file and logs a warning.
• Two files cannot claim the same destination.