Skill Claude Code needs its repo
Guides authoring and maintaining agent skills in this repository — enforcing Anthropic best practices, bumping versions, regenerating Cursor rules, and keeping the plugin structure consistent. Use when editing SKILL.md files, reference files, or plugin manifests; creating a new plugin; or reviewing a skill for…
Cursor rule Cursor
Cheat sheet: user intent → hawk op command. hawk op --help and hawk op --help are the canonical flag references.
Cursor rule Cursor
StackHawk API reporting recipes: org security posture summary, app deep dive (scan -> alerts -> findings), stale apps detection, scan diff (what changed since last scan). Pre-built compositions using hawk op commands. Prefer hawk op shortcuts (stackhawk-api-hawk-op) for the deep-dive chain; use these recipes for the…
Cursor rule Cursor
Use when querying the StackHawk platform for security reporting, findings analysis, or app management. Triggers include "stackhawk api", "security posture", "findings report", "show me findings", "untriaged findings", "which apps", "scan history", "security dashboard", "triage", "what needs attention". Uses the…
Cursor rule Cursor
Use when the user says "set up data for HawkScan", "my scan has no data to hit", "seed this repo for scanning", or as a first-time-setup step before invoking hawkscan on a fresh repo. Drives the 'hawk perch seed' subcommands (preflight, validate, finalize): runs the static pre-flight, designs the minimum seed manifest…
Cursor rule Cursor
HawkScan CI app-startup patterns reference: Docker Compose + wait-for-it, GitLab services keyword, GitHub Actions services map, build-then-run (Node, JVM), run-a-built-image, scan-existing-host (ephemeral env / preview deployment), networking gotchas (--network host vs host.docker.internal), health-check endpoint…
Cursor rule Cursor
HawkScan CI execution shapes reference: native action (stackhawk/hawkscan-action) vs Docker image (stackhawk/hawkscan) vs CLI download; pinning strategy; per-provider quick-reference recipes for GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Bitbucket, Buildkite, Travis, AWS CodeBuild; SARIF / Code…
Cursor rule Cursor
HawkScan CI failure semantics reference: exit codes 0/1/42, failureThreshold tuning, block-on-42 vs warn-only vs scheduled-baseline modes, retry strategy (don't retry 42), caching strategy (cache CLI/image, never findings), scheduled-vs-PR-trigger tradeoffs.
Cursor rule Cursor
Use when the user wants to WIRE HawkScan into a CI/CD pipeline config file — triggers on "set up hawkscan in CI", "add stackhawk to my pipeline", "scan in CI", "configure github actions / gitlab / jenkins / circleci for hawkscan", "wire hawkscan into ci/cd". Provider-agnostic: detects the CI system, edits the pipeline…
Cursor rule Cursor
For authentication, follow Phase 1c in SKILL.md (uses hawk config show --text).
Cursor rule Cursor
HawkScan Docker usage: standard container run, scanning localhost apps, custom config files, environment variables, CI Docker environments, network configuration for host access.
Cursor rule Cursor
HawkScan false positives guide: identifying false positives, deciding fix vs suppress, excludePaths and failureThreshold config, excluding scan plugins, reporting accepted risk.
Cursor rule Cursor
HawkScan findings reference: JSON output schema (--json-output), field reference, thresholdResult to exit code mapping, agentic fix task format, priority rules (severity, exploitability ordering), common findings quick reference (SQL injection, XSS, IDOR, path traversal, broken auth, information disclosure).
Cursor rule Cursor
HawkScan high-iteration findings guide: per-finding fix guidance for CSP, CORS, Auth (unprotected endpoint), and Missing Security Headers. Covers why each finding fires, minimal done fix, curl verification command, rescan expectation, and escalation threshold (2 rescans for CSP/CORS/Auth, 1 for Missing Headers). Use…
Cursor rule Cursor
HawkScan installation: Homebrew (macOS), manifest-driven binary download, package installers (.pkg/.msi), verification (hawk version). Self-contained binary — no separate Java install needed.
Cursor rule Cursor
HawkScan StackHawk platform model: Org → App → Env → Scan hierarchy, what goes in stackhawk.yml vs what doesn't, finding triage state machine (New/Accepted/False Positive/Reopened) and agent behavior per state, tags for commit traceability (STACKHAWKGITCOMMITSHA, STACKHAWKGITBRANCH), technology flags (platform UI only…
Cursor rule Cursor
HawkScan OpenAPI spec accuracy reference: framework-generic procedure for getting an accurate OpenAPI spec into openApiConf for a REST surface — prefer a spec the running app serves, suggest the code/build change that makes the framework generate one, verify it resolves against the app (base/context path), and derive…
Cursor rule Cursor
HawkScan scan-planning (discovery) reference: code-first discovery of an app's API surfaces before writing or editing stackhawk.yml — reading repo docs first, per-framework route inventory, recommending code changes for structural gaps, asking the user instead of guessing, and producing a per-surface stackhawk.yml…
Cursor rule Cursor
HawkScan scan-quality (post-scan quality gate) reference: run after every scan and rescan, before findings become fix tasks. Derives a fresh coverage expectation each run (spec-wired or route-inventory), the four coverage checks, and a bounded, additive-only stackhawk.yml config iteration to close gaps — never blocks…
Cursor rule Claude CodeCursor
HawkScan DAST security scanning. Use when the user asks to run or perform a security or DAST scan, to test an app or API for vulnerabilities, or to verify a vulnerability is fixed — and proactively right after you complete a code change (feature, bugfix, refactor); "done" means "done and secure" (configure, scan, fix…
Cursor rule Cursor
Optimize hawk op CLI contract: policy list/get/create/delete/assign and scan metrics commands the skill orchestrates, with flags and JSON output notes. The skill consumes these; it does not recompute metrics.
Cursor rule Cursor
Optimize codebase-to-config mapping: tech-flag detection heuristics (reuses hawkscan's evidence-file detection), plugin selection from a base preset, stackhawk.yml correctness (app type, OpenAPI, GraphQL, auth), and the default-balanced speed-vs-coverage profile lean.
Cursor rule Cursor
Optimize post-scan metrics refine loop: MetricsJson schema (paths/operations/flags/health), flag-to-lever mapping (concurrency for rate-limited/timeout-prone; excludePaths for heavy/slow paths; auth for auth-wall), auto-vs-confirm tiers, concurrency step-down (halve from current, floor 1), and the capped refine loop.
Cursor rule Cursor
Optimize trial lifecycle: how a named scan policy reaches a scan via S3 download (non-destructive), deterministic OPTIMIZETRIAL naming, crash-safe create/promote/discard sequences (orphan-policy and backup-file guards, reconstruct from the live policy), and failure handling.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: