hawkscan-ci

StackHawk Agent Skills

Your agent writes the code. Nothing checks if it's exploitable.

StackHawk agent skills fix that. Install once and your coding agent can configure security scans, run them against your live app, parse the findings, and fix what it found — all in the same session.

Try It Free

14 days free, no card required. auth.stackhawk.com/wingman

Your AI coding agent is also your security team.

StackHawk agent skills teach your AI coding agent to find security vulnerabilities as you build, report your security posture across applications, and help you fix what it finds — all without leaving your workflow. No context switching, no tickets to another team. Your agent scans, reports, and remediates.

Works with Claude Code, Codex, Gemini CLI, GitHub Copilot, OpenCode, Cursor, and anywhere the Agent Skills standard is supported.

---

Four Skills, One Security Workflow

hawkscan — Scan & Fix

Embeds HawkScan DAST scanning directly into your coding loop. Your agent configures the scanner, runs it against your live app, parses the findings, and generates prioritized fix tasks — then re-scans to confirm the fix worked.

Code changes → Configure HawkScan → Run scan → Parse findings → Fix → Re-scan

Use it when: you're building features, finishing a PR, or setting up security testing for a new project.

stackhawk-api — Report & Analyze

Queries the StackHawk platform API to give you a picture of your security posture across all your applications. Your agent authenticates, pulls findings data, and presents actionable summaries.

Question → Authenticate → Query API → Present Results → Suggest Next Actions

Use it when: you want to know what needs attention, what changed since the last scan, or which apps are falling behind.

hawkscan-ci — Wire It Into CI

Once HawkScan works locally, this skill graduates it into your CI/CD pipeline. It detects your CI provider, prompts for trigger and blocking behavior, and writes or patches the workflow file. Provider-agnostic — works with GitHub Actions, GitLab, Jenkins, CircleCI, and more.

Local scan works → Detect CI provider → Plan integration → Set secret (CI store or external manager) → Write workflow → Verify and report

Use it when: you have stackhawk.yml working locally and want every PR or scheduled build to scan automatically.

stackhawk-data-seed — Seed Scan Data

Drives the hawk perch seed flow to generate checked-in seed artifacts — SQL scripts, HTTP fixtures, gRPC stubs, and a credentials handoff file — so HawkScan has real data to reach non-trivial application paths.

Analyze repo → Design seed manifest → Generate artifacts → Finalize and hand off to hawkscan

Use it when: your scan is hitting dead ends because endpoints require specific request data or auth state to reach.

---

Quick Start

1. Get your API key

Sign up or log in at app.stackhawk.com, go to Settings → API Keys, and create a key.

export HAWK_API_KEY=hawk.xxxxxxxxxxxx.xxxxxxxxxxxx

2. Install for your platform

Claude Code

/plugin marketplace add stackhawk/agent-skills
/plugin install wingman@stackhawk      # installs hawkscan + api + data-seed + optimize

Advanced — install individually instead:

# /plugin install hawkscan@stackhawk
# /plugin install stackhawk-api@stackhawk
# /plugin install hawkscan-ci@stackhawk
# /plugin install stackhawk-data-seed@stackhawk
# /plugin install stackhawk-optimize@stackhawk

Codex

/plugin marketplace add stackhawk/agent-skills
/plugin install hawkscan@stackhawk
/plugin install stackhawk-api@stackhawk
/plugin install hawkscan-ci@stackhawk
/plugin install stackhawk-data-seed@stackhawk
/plugin install stackhawk-optimize@stackhawk

If your Codex version supports umbrella dependency auto-install, you may use /plugin install wingman@stackhawk instead.

Gemini CLI

gemini extensions install https://github.com/stackhawk/agent-skills

GitHub Copilot

copilot plugin marketplace add stackhawk/agent-skills-marketplace
copilot plugin install hawkscan@stackhawk
copilot plugin install stackhawk-api@stackhawk
copilot plugin install hawkscan-ci@stackhawk
copilot plugin install stackhawk-data-seed@stackhawk
copilot plugin install stackhawk-optimize@stackhawk

Installs hawkscan, stackhawk-api, hawkscan-ci, stackhawk-data-seed, and stackhawk-optimize into ~/.agents/skills/. Confirm they appear under GitHub Copilot → Configure Skills in VS Code.

OpenCode

Skills are auto-discovered from .opencode/skills/. Clone and copy (-L dereferences the repo's internal skill symlinks so the copies work standalone):