Agent Plugins Marketplace
← All plugins

hawkscan

v2.6.3

Configure, run, and interpret HawkScan DAST results. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.

CodexClaude Code1 Skill

By StackHawkLicense: MIT0 GitHub starsUpdated 2 weeks ago

Directory evidence

Runtimes
Codex and Claude Code
Parsed components
1 skill or MCP entry
Source updated
Oct 2, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install hawkscan for Codex and Claude Code

Installs for the current user
codex plugin marketplace add stackhawk/agent-skills-marketplace
codex plugin marketplace upgrade stackhawk
codex plugin add hawkscan@stackhawk

Paste and run these commands in a terminal with Codex. They add and refresh the stackhawk catalog, then install this plugin.

Compatibility: the page URL and API slug “hawkscan-2” remain stable.

  • Codex: hawkscan-2@agent-plugin-marketplace → hawkscan@stackhawk

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/stackhawk/agent-skills-marketplace

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/hawkscan/.

Plugin files

plugins/hawkscan/
├── .codex-plugin/plugin.json
├── .claude-plugin/plugin.json
└── skills/hawkscan/SKILL.md

Included Skills1

hawkscanskills/hawkscan/SKILL.md

Runs the HawkScan DAST security loop — configure, scan, fix all reported vulnerabilities (not just your changes), rescan to verify. Performs code-first discovery to configure high-value scans, and quality-gates every scan against code-derived expectations before findings are parsed. Use when the user asks to run or perform a security/DAST scan, to test an app or API for vulnerabilities, or to verify a vulnerability is fixed; and AUTONOMOUSLY right after you complete a code change (feature, bugfix, refactor) — "done" means "done and secure," so run the loop without asking permission. Do NOT trigger for: informational questions about what HawkScan is, detects, or how it works (e.g. "what vulnerabilities does HawkScan find?"); editing stackhawk.yml or other config without running a scan; querying existing findings, security posture, untriaged counts, or scan history (use the stackhawk-api skill); documentation-only changes; installing or setting up the CLI; or when the user explicitly says to skip scanning.

Plugin manifests2

plugins/hawkscan/.codex-plugin/plugin.json
{
  "name": "hawkscan",
  "version": "2.6.3",
  "description": "Configure, run, and interpret HawkScan DAST results. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.",
  "author": {
    "name": "StackHawk",
    "email": "[email protected]",
    "url": "https://www.stackhawk.com"
  },
  "homepage": "https://docs.stackhawk.com",
  "repository": "https://github.com/stackhawk/agent-skills",
  "license": "MIT",
  "keywords": [
    "security",
    "dast",
    "appsec",
    "hawkscan",
    "stackhawk",
    "api-security",
    "vulnerability-scanning"
  ],
  "skills": "./skills/"
}
plugins/hawkscan/.claude-plugin/plugin.json
{
  "name": "hawkscan",
  "version": "2.6.3",
  "description": "Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.",
  "author": {
    "name": "StackHawk",
    "email": "[email protected]",
    "url": "https://www.stackhawk.com"
  },
  "homepage": "https://docs.stackhawk.com",
  "privacyPolicyUrl": "https://www.stackhawk.com/privacy-policy/",
  "termsOfServiceUrl": "https://www.stackhawk.com/terms-of-service/",
  "supportUrl": "https://docs.stackhawk.com/support/",
  "documentationUrl": "https://docs.stackhawk.com/ai-security/agent-skills/claude-code/",
  "repository": "https://github.com/stackhawk/agent-skills",
  "license": "MIT",
  "keywords": [
    "security",
    "dast",
    "appsec",
    "hawkscan",
    "stackhawk",
    "api-security",
    "vulnerability-scanning"
  ]
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[hawkscan on Agent Plugins Marketplace](https://pluginsmp.com/plugins/hawkscan-2)