Stackhawk API

StackHawk Agent Skills

Your agent writes the code. Nothing checks if it's exploitable.

StackHawk agent skills fix that. Install once and your coding agent can configure security scans, run them against your live app, parse the findings, and fix what it found — all in the same session.

Try It Free

14 days free, no card required. auth.stackhawk.com/wingman

Your AI coding agent is also your security team.

StackHawk agent skills teach your AI coding agent to find security vulnerabilities as you build, report your security posture across applications, and help you fix what it finds — all without leaving your workflow. No context switching, no tickets to another team. Your agent scans, reports, and remediates.

Works with Claude Code, Codex, Gemini CLI, GitHub Copilot, OpenCode, Cursor, and anywhere the Agent Skills standard is supported.

---

Four Skills, One Security Workflow

hawkscan — Scan & Fix

Embeds HawkScan DAST scanning directly into your coding loop. Your agent configures the scanner, runs it against your live app, parses the findings, and generates prioritized fix tasks — then re-scans to confirm the fix worked.

Code changes → Configure HawkScan → Run scan → Parse findings → Fix → Re-scan

Use it when: you're building features, finishing a PR, or setting up security testing for a new project.

stackhawk-api — Report & Analyze

Queries the StackHawk platform API to give you a picture of your security posture across all your applications. Your agent authenticates, pulls findings data, and presents actionable summaries.

Question → Authenticate → Query API → Present Results → Suggest Next Actions

Use it when: you want to know what needs attention, what changed since the last scan, or which apps are falling behind.

hawkscan-ci — Wire It Into CI

Once HawkScan works locally, this skill graduates it into your CI/CD pipeline. It detects your CI provider, prompts for trigger and blocking behavior, and writes or patches the workflow file. Provider-agnostic — works with GitHub Actions, GitLab, Jenkins, CircleCI, and more.