Prompt התקנה עצמית לאייג׳נט
שלח את הטקסט הבא ל־Codex, Kimi, Claude או Agent אחר. הוא בנוי כהליך קשיח: גילוי, בחירת מצב יחיד, בדיקות מקדימות, ביצוע, ניטור ותנאי סיום.
Connect yourself to the private Strix Security Portal at https://strix.greener-business.com and follow this procedure exactly.
SETUP
1. Ask me for a scoped STRIX_PORTAL_TOKEN. Never print, log, commit, or repeat the token.
2. Download and inspect these exact files before installation:
https://strix.greener-business.com/agent/skill.md
https://strix.greener-business.com/agent/strix_portal_mcp.py
3. Follow the "Install the MCP adapter" section in SKILL.md. If the MCP client type or install path is unknown, ask me; do not invent configuration.
4. After connection, call strix_capabilities and strix_list_scans. If either fails, stop and report the exact error category without exposing secrets.
CHOOSE EXACTLY ONE EXECUTION MODE
A. PORTAL-MANAGED: choose provider=codex, smart-router, or openrouter. The portal runs Strix and pays from the configured portal provider.
B. OWN MODEL/BUDGET: choose provider=external-agent only if you have your own network/browser/security tools. You perform the assessment; the portal only stores scope, sanitized progress, evidence, findings, and artifacts. If you lack the required tools, do not choose this mode.
BEFORE ANY SCAN
5. Obtain the exact target, authorization confirmation, backup confirmation, allowed test window, traffic constraints, and forbidden actions. Verify the prompt contains no credentials, regulated data, or customer PII. Never set authorized=true, backup_confirmed=true, or sensitive_data_excluded=true unless each statement is true.
6. List existing scans and do not create a duplicate for the same target while one is queued, running, or awaiting_agent.
PORTAL-MANAGED FLOW
7A. Call strix_start_scan with provider codex, smart-router, or openrouter. Include sensitive_data_excluded=true only after verifying the prompt contains no credentials or restricted data. Save scan_id.
8A. Poll strix_get_scan every 15-30 seconds. Smart Router may be silent for up to 420 seconds; do not start another scan while waiting.
9A. At a terminal state, call strix_get_findings and strix_list_artifacts. Treat results as final only when status=completed and findings complete=true and authoritative=true.
OWN MODEL/BUDGET FLOW
7B. Call strix_start_scan with provider=external-agent and save scan_id.
8B. Perform only authorized, non-destructive checks with your own tools. For production API abuse testing use self-owned objects, reversible/read-only requests, low request rates, and minimum evidence samples. Send strix_external_heartbeat every 30-90 seconds using generic status only; never send chain-of-thought, credentials, secrets, personal data, or private reasoning.
9B. For each validated issue call strix_external_submit_finding with title, severity, technical_analysis, evidence, impact, reproduction, remediation, affected endpoint/component, and confidence. Never submit a hypothesis as a confirmed finding.
10B. Call strix_external_complete exactly once with an honest summary and explicit coverage gaps.
DEFINITION OF DONE
10. Report validated findings separately from hypotheses and coverage gaps. Give the developer exact affected component, evidence, minimum-impact reproduction, business impact, concrete remediation, and a verification test.
11. Never claim a failed, cancelled, interrupted, timed_out, incomplete, or non-authoritative assessment proves the target is clean.
12. Stop before destructive, persistent, denial-of-service, privacy-impacting, credential-access, or data-exfiltration actions.