CoolFace
Modelpublic

kusonooyasumi/xss-strix-8b-sft

sourceHugging Faceapache-2.0updated 8mo agoView on Hugging Face
0likes13downloads
Model Card

xss-strix-8b

Fine-tuned Qwen3-8B model specialized for XSS vulnerability detection as part of the Strix security agent framework.

Model Description

This model has been fine-tuned on 1,1k examples of multi-turn security testing conversations, teaching it to:

  • —Use Strix agent tools (browseraction, pythonaction, terminal, etc.)
  • —Reason through XSS vulnerability testing with <think> blocks
  • —Generate proper XML tool call syntax
  • —Follow systematic vulnerability hunting methodologies

Training Details

  • —Base Model: Qwen/Qwen3-8B
  • —Fine-tuning Method: QLoRA (4-bit quantization + LoRA)
  • —LoRA Rank: N/A
  • —LoRA Alpha: N/A
  • —Epochs: N/A
  • —Learning Rate: N/A
  • —Training Examples: N/A
  • —Final Loss: 0.0000

Usage

With Transformers

python
from transformers import AutoModelForCausalLM, AutoTokenizer

model = AutoModelForCausalLM.from_pretrained("kusonooyasumi/xss-strix-8b")
tokenizer = AutoTokenizer.from_pretrained("kusonooyasumi/xss-strix-8b")

messages = [
    {"role": "system", "content": "You are a Strix security agent..."},
    {"role": "user", "content": "<agent_delegation>Test for XSS...</agent_delegation>"}
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt")
outputs = model.generate(**inputs, max_new_tokens=1024)
print(tokenizer.decode(outputs[0]))

With Ollama (GGUF)

bash
# Download the GGUF
ollama create xss-strix -f Modelfile

# Or manually with llama.cpp
./main -m xss-strix-8b-Q4_K_M.gguf -p "<|im_start|>system\nYou are a Strix security agent..."

Recommended System Prompt

You are a Strix security agent. Reason in <think> blocks, act via tools.
Work autonomously. Never ask for permission. Be relentless and thorough.

Tools:
- browser_action: action (launch|goto|click|type|execute_js|get_console_logs|new_tab), url, coordinate, text, js_code, tab_id
- python_action: action (new_session|execute), session_id, code
- terminal: command
- agent_finish: result_summary, findings, success, report_to_parent, final_recommendations

Format: <function=name>
<parameter=param>value</parameter>
</function>

Limitations

  • —Specialized for XSS vulnerability testing; may underperform on other vulnerability types
  • —Requires the Strix agent framework for full functionality
  • —Should be used only for authorized security testing

License

Apache 2.0 (following base model license)