Your agent writes the code. Nothing checks if it's exploitable.
StackHawk agent skills fix that. Install once and your coding agent can configure security scans, run them against your live app, parse the findings, and fix what it found — all in the same session.
14 days free, no card required. auth.stackhawk.com/wingman
Your AI coding agent is also your security team.
StackHawk agent skills teach your AI coding agent to find security vulnerabilities as you build, report your security posture across applications, and help you fix what it finds — all without leaving your workflow. No context switching, no tickets to another team. Your agent scans, reports, and remediates.
Works with Claude Code, Codex, Gemini CLI, GitHub Copilot, OpenCode, Cursor, and anywhere the Agent Skills standard is supported.
hawkscan — Scan & Fix
Embeds HawkScan DAST scanning directly into your coding loop. Your agent configures the scanner, runs it against your live app, parses the findings, and generates prioritized fix tasks — then re-scans to confirm the fix worked.
Code changes → Configure HawkScan → Run scan → Parse findings → Fix → Re-scan
Use it when: you're building features, finishing a PR, or setting up security testing for a new project.
stackhawk-api — Report & Analyze
Queries the StackHawk platform API to give you a picture of your security posture across all your applications. Your agent authenticates, pulls findings data, and presents actionable summaries.
Question → Authenticate → Query API → Present Results → Suggest Next Actions
Use it when: you want to know what needs attention, what changed since the last scan, or which apps are falling behind.
hawkscan-ci — Wire It Into CI
Once HawkScan works locally, this skill graduates it into your CI/CD pipeline. It detects your CI provider, prompts for trigger and blocking behavior, and writes or patches the workflow file. Provider-agnostic — works with GitHub Actions, GitLab, Jenkins, CircleCI, and more.
Local scan works → Detect CI provider → Plan integration → Set secret (CI store or external manager) → Write workflow → Verify and report
Use it when: you have stackhawk.yml working locally and want every PR or scheduled build to scan automatically.
stackhawk-data-seed — Seed Scan Data
Drives the hawk perch seed flow to generate checked-in seed artifacts — SQL scripts, HTTP fixtures, gRPC stubs, and a credentials handoff file — so HawkScan has real data to reach non-trivial application paths.
Analyze repo → Design seed manifest → Generate artifacts → Finalize and hand off to hawkscan
Use it when: your scan is hitting dead ends because endpoints require specific request data or auth state to reach.
Sign up or log in at app.stackhawk.com, go to Settings → API Keys, and create a key.
export HAWK_API_KEY=hawk.xxxxxxxxxxxx.xxxxxxxxxxxx/plugin marketplace add stackhawk/agent-skills
/plugin install wingman@stackhawk # installs hawkscan + api + data-seed + optimize
Advanced — install individually instead:
# /plugin install hawkscan@stackhawk
# /plugin install stackhawk-api@stackhawk
# /plugin install hawkscan-ci@stackhawk
# /plugin install stackhawk-data-seed@stackhawk
# /plugin install stackhawk-optimize@stackhawk
/plugin marketplace add stackhawk/agent-skills
/plugin install hawkscan@stackhawk
/plugin install stackhawk-api@stackhawk
/plugin install hawkscan-ci@stackhawk
/plugin install stackhawk-data-seed@stackhawk
/plugin install stackhawk-optimize@stackhawk
If your Codex version supports umbrella dependency auto-install, you may use /plugin install wingman@stackhawk instead.
gemini extensions install https://github.com/stackhawk/agent-skillscopilot plugin marketplace add stackhawk/agent-skills-marketplace
copilot plugin install hawkscan@stackhawk
copilot plugin install stackhawk-api@stackhawk
copilot plugin install hawkscan-ci@stackhawk
copilot plugin install stackhawk-data-seed@stackhawk
copilot plugin install stackhawk-optimize@stackhawk
Installs hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, and stackhawk-optimize into ~/.agents/skills/. Confirm they appear under GitHub Copilot → Configure Skills in VS Code.
Skills are auto-discovered from .opencode/skills/. Clone and copy (-L dereferences
the repo's internal skill symlinks so the copies work standalone):
git clone https://github.com/stackhawk/agent-skills.git
mkdir -p .opencode/skills
cp -rL agent-skills/.opencode/skills/* .opencode/skills/
# Global install (all projects):
mkdir -p ~/.config/opencode/skills
cp -rL agent-skills/.opencode/skills/* ~/.config/opencode/skills/Installs hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, and stackhawk-optimize.
# macOS / Linux
git clone https://github.com/stackhawk/agent-skills.git
bash agent-skills/scripts/install.sh --platform cursor --target .# Windows
git clone https://github.com/stackhawk/agent-skills.git
.\agent-skills\scripts\install.ps1 -Platform cursorInstalls Cursor rules (.cursor/rules/), skills (.cursor/skills/), and the stop hook that auto-triggers a scan when you finish coding.
> "Scan my API for security vulnerabilities"
> "What's my security posture across all apps?"
| Say this... | Your agent will... |
|---|---|
| "Set up HawkScan for my Express API" | Generate a stackhawk.yml config based on your stack |
| "Scan my app for security issues" | Validate config, run hawk scan, parse findings |
| "Turn these scan findings into fix tasks" | Prioritize by severity, generate actionable fix guidance |
| "I'm finishing up this feature" | Proactively suggest a security scan before you merge |
| "My HawkScan auth is failing" | Debug your authentication configuration |
| "Set up HawkScan in my CI pipeline" | Generate CI-specific config with commit tagging |
| Say this... | Your agent will... |
|---|---|
| "What's my security posture?" | Pull untriaged findings across all apps, present as a summary table |
| "Show me findings for payment-api" | Drill down: scan → alerts → findings with severity, CWE, paths |
| "Which apps haven't been scanned recently?" | Flag stale apps with no scan in 30+ days |
| "What changed since the last scan?" | Diff two scans, show new and resolved findings |
API & App Types: REST/OpenAPI, GraphQL, gRPC, SOAP, JSON-RPC, standard web apps
Authentication Patterns: Bearer token injection, form login (username/password), cookie sessions, OAuth2/external IdP (Auth0, Okta, Cognito), external command, custom scripts
Scan Runtimes: hawk CLI (recommended for local/agentic use), Docker (stackhawk/hawkscan)
Environments: Local development, CI/CD (GitHub Actions, GitLab CI, Jenkins, etc.)
These are Agent Skills — they teach AI coding agents domain-specific knowledge through structured markdown files. No runtime dependencies are installed. No code runs in the background.
- Skill files define step-by-step workflows with decision logic (assess → configure → execute → parse → act)
- Reference files provide endpoint catalogs, config patterns, and pre-built recipes loaded on demand
- The hawkscan skill calls the
hawkCLI or Docker to run scans - The api skill calls the StackHawk REST API via
curlandjq
plugins/
├── hawkscan/ HawkScan DAST scanning
│ └── skills/hawkscan/
│ ├── SKILL.md scan workflow
│ └── references/ CLI flags, config patterns, findings schema, Docker, install
├── api/ StackHawk API reporting
│ └── skills/api/
│ ├── SKILL.md reporting workflow
│ └── references/ auth flow, endpoint catalog, reporting recipes
├── hawkscan-ci/ CI/CD pipeline integration
│ └── skills/hawkscan-ci/
│ ├── SKILL.md CI wiring workflow
│ └── references/ execution shapes, app startup, failure semantics
└── stackhawk-data-seed/ Scan data seeding
└── skills/stackhawk-data-seed/
└── SKILL.md hawk perch seed workflow
skills/ Symlinks for Gemini/Copilot discovery
cursor/ Generated Cursor .mdc rules
scripts/install.sh Installer for Cursor and Copilot (macOS/Linux)
scripts/install.ps1 Installer for Cursor and Copilot (Windows)
| Platform | Install Method | Skills Available |
|---|---|---|
| Claude Code | /plugin install |
hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, stackhawk-optimize |
| Codex | /plugin install |
hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, stackhawk-optimize |
| Gemini CLI | gemini extensions install |
hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, stackhawk-optimize |
| GitHub Copilot | copilot plugin install |
hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, stackhawk-optimize |
| OpenCode | Copy to .opencode/skills/ |
hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, stackhawk-optimize |
| Cursor | install.sh --platform cursor |
hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, stackhawk-optimize |
| Requirement | For scanning | For reporting |
|---|---|---|
| StackHawk account (free tier available) | Required | Required |
HAWK_API_KEY environment variable |
Required | Required |
hawk CLI or Docker |
Required | — |
jq |
— | Required |
| A running application to scan | Required | — |
Never hardcode your HAWK_API_KEY in config files or scripts. Always use environment variables:
# Good
export HAWK_API_KEY=hawk.xxxxxxxxxxxx.xxxxxxxxxxxx
# Bad — never do this
# api_key: hawk.xxxxxxxxxxxx.xxxxxxxxxxxx ← in stackhawk.ymlThe hawkscan skill enforces ${HAWK_API_KEY} interpolation in all generated configs. The api skill stores tokens in shell variables only — never written to disk.
- HawkScan Documentation
- StackHawk CLI Reference
- StackHawk API Reference
- Auth Configuration Examples
- Agent Skills Specification
- StackHawk Platform
- StackHawk Support
Skill eval pass rates at the latest release, broken down by skill. Each badge is one agent (tool × model); the score is the deterministic pass rate across that skill's eval prompts.
Configures HawkScan, runs StackHawk against your app, fixes the vulnerabilities it finds, and rescans to verify.
Queries the StackHawk platform API for findings, scan history, and security posture across your apps.
Sets up checked-in seed data so authenticated scans can reach non-trivial application paths.
Wires HawkScan into your CI/CD pipeline — detects the provider and writes the workflow file.
This repository is maintained by the StackHawk team. To report issues or suggest improvements, open a GitHub issue or contact support@stackhawk.com.
MIT © StackHawk