Cursor rule Cursor
Cheat sheet: user intent → hawk op command. hawk op --help and hawk op --help are the canonical flag references.
not rated 16
changed 1mo ago B 61 tokens
original MIT
16Stars on the repository
48Mods indexed here, across every type
8d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
Cursor rule Cursor
StackHawk API reporting recipes: org security posture summary, app deep dive (scan -> alerts -> findings), stale apps detection, scan diff (what changed since last scan). Pre-built compositions using hawk op commands. Prefer hawk op shortcuts (stackhawk-api-hawk-op) for the deep-dive chain; use these recipes for the…
not rated 16
changed 1mo ago A 77 tokens
original MIT
Cursor rule Cursor
Use when querying the StackHawk platform for security reporting, findings analysis, or app management. Triggers include "stackhawk api", "security posture", "findings report", "show me findings", "untriaged findings", "which apps", "scan history", "security dashboard", "triage", "what needs attention". Uses the…
not rated 16
changed 1mo ago A 137 tokens
original MIT
Cursor rule Cursor
Use when the user says "set up data for HawkScan", "my scan has no data to hit", "seed this repo for scanning", or as a first-time-setup step before invoking hawkscan on a fresh repo. Drives the 'hawk perch seed' subcommands (preflight, validate, finalize): runs the static pre-flight, designs the minimum seed manifest…
not rated 16 8d ago A 0 tokens
original MIT
Cursor rule Cursor
HawkScan CI app-startup patterns reference: Docker Compose + wait-for-it, GitLab services keyword, GitHub Actions services map, build-then-run (Node, JVM), run-a-built-image, scan-existing-host (ephemeral env / preview deployment), networking gotchas (--network host vs host.docker.internal), health-check endpoint…
not rated 16 8d ago A 70 tokens
original MIT
Cursor rule Cursor
HawkScan CI execution shapes reference: native action (stackhawk/hawkscan-action) vs Docker image (stackhawk/hawkscan) vs CLI download; pinning strategy; per-provider quick-reference recipes for GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Bitbucket, Buildkite, Travis, AWS CodeBuild; SARIF / Code…
not rated 16 8d ago B 79 tokens
original MIT
Cursor rule Cursor
HawkScan CI failure semantics reference: exit codes 0/1/42, failureThreshold tuning, block-on-42 vs warn-only vs scheduled-baseline modes, retry strategy (don't retry 42), caching strategy (cache CLI/image, never findings), scheduled-vs-PR-trigger tradeoffs.
not rated 16 8d ago A 61 tokens
original MIT
Cursor rule Cursor
Use when the user wants to WIRE HawkScan into a CI/CD pipeline config file — triggers on "set up hawkscan in CI", "add stackhawk to my pipeline", "scan in CI", "configure github actions / gitlab / jenkins / circleci for hawkscan", "wire hawkscan into ci/cd". Provider-agnostic: detects the CI system, edits the pipeline…
not rated 16
changed 23d ago A 0 tokens
original MIT
Cursor rule Cursor
For authentication, follow Phase 1c in SKILL.md (uses hawk config show --text).
not rated 16
changed 19d ago A 0 tokens
original MIT
Cursor rule Cursor
HawkScan Docker usage: standard container run, scanning localhost apps, custom config files, environment variables, CI Docker environments, network configuration for host access.
not rated 16 8d ago A 0 tokens
original MIT
Cursor rule Cursor
HawkScan false positives guide: identifying false positives, deciding fix vs suppress, excludePaths and failureThreshold config, excluding scan plugins, reporting accepted risk.
not rated 16 8d ago A 31 tokens
original MIT
Cursor rule Cursor
HawkScan findings reference: JSON output schema (--json-output), field reference, thresholdResult to exit code mapping, agentic fix task format, priority rules (severity, exploitability ordering), common findings quick reference (SQL injection, XSS, IDOR, path traversal, broken auth, information disclosure).
not rated 16
changed 8d ago A 61 tokens
original MIT
Cursor rule Cursor
HawkScan high-iteration findings guide: per-finding fix guidance for CSP, CORS, Auth (unprotected endpoint), and Missing Security Headers. Covers why each finding fires, minimal done fix, curl verification command, rescan expectation, and escalation threshold (2 rescans for CSP/CORS/Auth, 1 for Missing Headers). Use…
not rated 16 8d ago A 92 tokens
original MIT
Cursor rule Cursor
HawkScan installation: Homebrew (macOS), manifest-driven binary download, package installers (.pkg/.msi), verification (hawk version). Self-contained binary — no separate Java install needed.
not rated 16
changed 1mo ago B 39 tokens
original MIT
Cursor rule Cursor
HawkScan StackHawk platform model: Org → App → Env → Scan hierarchy, what goes in stackhawk.yml vs what doesn't, finding triage state machine (New/Accepted/False Positive/Reopened) and agent behavior per state, tags for commit traceability (STACKHAWKGITCOMMITSHA, STACKHAWKGITBRANCH), technology flags (platform UI only…
not rated 16
changed 1mo ago A 111 tokens
original MIT
Cursor rule Cursor
HawkScan OpenAPI spec accuracy reference: framework-generic procedure for getting an accurate OpenAPI spec into openApiConf for a REST surface — prefer a spec the running app serves, suggest the code/build change that makes the framework generate one, verify it resolves against the app (base/context path), and derive…
not rated 16 8d ago A 92 tokens
original MIT
Cursor rule Cursor
HawkScan scan-planning (discovery) reference: code-first discovery of an app's API surfaces before writing or editing stackhawk.yml — reading repo docs first, per-framework route inventory, recommending code changes for structural gaps, asking the user instead of guessing, and producing a per-surface stackhawk.yml…
not rated 16
changed 8d ago A 88 tokens
original MIT
Cursor rule Cursor
HawkScan scan-quality (post-scan quality gate) reference: run after every scan and rescan, before findings become fix tasks. Derives a fresh coverage expectation each run (spec-wired or route-inventory), the four coverage checks, and a bounded, additive-only stackhawk.yml config iteration to close gaps — never blocks…
not rated 16 8d ago A 76 tokens
original MIT
Cursor rule Claude CodeCursor
HawkScan DAST security scanning. Use when the user asks to run or perform a security or DAST scan, to test an app or API for vulnerabilities, or to verify a vulnerability is fixed — and proactively right after you complete a code change (feature, bugfix, refactor); "done" means "done and secure" (configure, scan, fix…
not rated 16
changed 8d ago A 7,301 tokens
original MIT
Cursor rule Cursor
Optimize hawk op CLI contract: policy list/get/create/delete/assign and scan metrics commands the skill orchestrates, with flags and JSON output notes. The skill consumes these; it does not recompute metrics.
not rated 16 8d ago A 42 tokens
original MIT
Cursor rule Cursor
Optimize codebase-to-config mapping: tech-flag detection heuristics (reuses hawkscan's evidence-file detection), plugin selection from a base preset, stackhawk.yml correctness (app type, OpenAPI, GraphQL, auth), and the default-balanced speed-vs-coverage profile lean.
not rated 16
changed 1mo ago A 59 tokens
original MIT
Cursor rule Cursor
Optimize post-scan metrics refine loop: MetricsJson schema (paths/operations/flags/health), flag-to-lever mapping (concurrency for rate-limited/timeout-prone; excludePaths for heavy/slow paths; auth for auth-wall), auto-vs-confirm tiers, concurrency step-down (halve from current, floor 1), and the capped refine loop.
not rated 16 8d ago A 74 tokens
original MIT
Cursor rule Cursor
Optimize trial lifecycle: how a named scan policy reaches a scan via S3 download (non-destructive), deterministic OPTIMIZETRIAL naming, crash-safe create/promote/discard sequences (orphan-policy and backup-file guards, reconstruct from the live policy), and failure handling.
not rated 16
changed 1mo ago A 62 tokens
original MIT
Cursor rule Cursor
Use when the user asks to optimize, tune, or speed up a HawkScan scan, reduce false positives, or pick the right scan policy/plugins/tech flags for an app — or invokes /optimize. Analyzes the codebase, builds an isolated trial scan policy, runs one trial scan, and promotes or discards. Do NOT use for a normal scan or…
not rated 16
changed 1mo ago A 98 tokens
original MIT
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: