stackhawk-hawkscan

Configure, run, and interpret HawkScan DAST results inside Claude Code. Generates stackhawk.yml configs, runs scans via CLI or Docker, and transforms security findings into prioritized fix tasks for your coding agent.

Install

If the official marketplace isn’t added yet, run

Category: Security
Author: StackHawk
GitHub: stackhawk/agent-skills
Website: docs.stackhawk.com

Good for

Generate stackhawk.yml configs
Run HawkScan DAST scans against your live app via CLI or Docker
Turn findings into prioritized fix tasks, then re-scan to confirm fixes

Getting started

Create a key under Settings → API Keys at app.stackhawk.com and export it as HAWK_API_KEY
Run /plugin install stackhawk-hawkscan@claude-plugins-official
Start your app, ask Claude to configure and run HawkScan, then fix what it finds

Before you install

Requires a StackHawk account and API key; a 14-day free trial is available. Scans run against your running app.

Summarized by AI from the project docs; check the official docs before relying on it.

Similar tools

stackhawk-apiOfficial plugin · Security
Query the StackHawk platform API for security posture reporting, findings analysis, and app management. Guides agents through authentication, data retrieval, and result presentation.
claude-securityOfficial plugin · Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.
security-guidanceOfficial plugin · Security
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
42crunch-api-security-testingOfficial plugin · Security
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
auth0Official plugin · Security
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.