Cursor rule Cursor
Cheat sheet: user intent → hawk op command. hawk op --help and hawk op --help are the canonical flag references.
15 11d ago B 61 tokens
original MIT
15Stars on the repository
44Mods indexed here, across every type
11d agoLast push, which is what freshness is scored on
MITLicence, which decides whether bodies are shown
Cursor rule Cursor
StackHawk API reporting recipes: org security posture summary, app deep dive (scan -> alerts -> findings), stale apps detection, scan diff (what changed since last scan). Pre-built compositions using hawk op commands. Prefer hawk op shortcuts (stackhawk-api-hawk-op) for the deep-dive chain; use these recipes for the…
15 11d ago A 77 tokens
original MIT
Cursor rule Cursor
Use when querying the StackHawk platform for security reporting, findings analysis, or app management. Triggers include "stackhawk api", "security posture", "findings report", "show me findings", "untriaged findings", "which apps", "scan history", "security dashboard", "triage", "what needs attention". Uses the…
15 11d ago A 137 tokens
original MIT
Cursor rule Cursor
Use when the user says "set up data for HawkScan", "my scan has no data to hit", "seed this repo for scanning", or as a first-time-setup step before invoking hawkscan on a fresh repo. Drives the 'hawk perch seed' subcommands (preflight, validate, finalize): runs the static pre-flight, designs the minimum seed manifest…
15 11d ago A 0 tokens
original MIT
Cursor rule Cursor
HawkScan CI app-startup patterns reference: Docker Compose + wait-for-it, GitLab services keyword, GitHub Actions services map, build-then-run (Node, JVM), run-a-built-image, scan-existing-host (ephemeral env / preview deployment), networking gotchas (--network host vs host.docker.internal), health-check endpoint…
15 11d ago A 70 tokens
original MIT
Cursor rule Cursor
HawkScan CI execution shapes reference: native action (stackhawk/hawkscan-action) vs Docker image (stackhawk/hawkscan) vs CLI download; pinning strategy; per-provider quick-reference recipes for GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, Bitbucket, Buildkite, Travis, AWS CodeBuild; SARIF / Code…
15 11d ago B 79 tokens
original MIT
Cursor rule Cursor
HawkScan CI failure semantics reference: exit codes 0/1/42, failureThreshold tuning, block-on-42 vs warn-only vs scheduled-baseline modes, retry strategy (don't retry 42), caching strategy (cache CLI/image, never findings), scheduled-vs-PR-trigger tradeoffs.
15 11d ago A 61 tokens
original MIT
Cursor rule Cursor
Use when the user wants to WIRE HawkScan into a CI/CD pipeline config file — triggers on "set up hawkscan in CI", "add stackhawk to my pipeline", "scan in CI", "configure github actions / gitlab / jenkins / circleci for hawkscan", "wire hawkscan into ci/cd". Provider-agnostic: detects the CI system, edits the pipeline…
15 11d ago A 0 tokens
original MIT
Cursor rule Cursor
The hawk CLI is preferred for local/agentic use — lower overhead than Docker, faster iteration on config, and better localhost networking.
15 11d ago A 57 tokens
original MIT
Cursor rule Cursor
For authentication, follow Phase 1c in SKILL.md (uses hawk config show --text).
15 11d ago A 0 tokens
original MIT
Cursor rule Cursor
HawkScan Docker usage: standard container run, scanning localhost apps, custom config files, environment variables, CI Docker environments, network configuration for host access.
15 11d ago A 0 tokens
original MIT
Cursor rule Cursor
HawkScan false positives guide: identifying false positives, deciding fix vs suppress, excludePaths and failureThreshold config, excluding scan plugins, reporting accepted risk.
15 11d ago A 31 tokens
original MIT
Cursor rule Cursor
HawkScan findings reference: JSON output schema (--json-output), field reference, thresholdResult to exit code mapping, agentic fix task format, priority rules (severity, exploitability ordering), common findings quick reference (SQL injection, XSS, IDOR, path traversal, broken auth, information disclosure).
15 11d ago A 61 tokens
original MIT
Cursor rule Cursor
HawkScan high-iteration findings guide: per-finding fix guidance for CSP, CORS, Auth (unprotected endpoint), and Missing Security Headers. Covers why each finding fires, minimal done fix, curl verification command, rescan expectation, and escalation threshold (2 rescans for CSP/CORS/Auth, 1 for Missing Headers). Use…
15 11d ago A 92 tokens
original MIT
Cursor rule Cursor
HawkScan installation: Homebrew (macOS), manifest-driven binary download, package installers (.pkg/.msi), verification (hawk version). Self-contained binary — no separate Java install needed.
15 11d ago B 39 tokens
original MIT
Cursor rule Cursor
HawkScan StackHawk platform model: Org → App → Env → Scan hierarchy, what goes in stackhawk.yml vs what doesn't, finding triage state machine (New/Accepted/False Positive/Reopened) and agent behavior per state, tags for commit traceability (STACKHAWKGITCOMMITSHA, STACKHAWKGITBRANCH), technology flags (platform UI only…
15 11d ago A 111 tokens
original MIT
Cursor rule Cursor
HawkScan OpenAPI spec accuracy reference: framework-generic procedure for getting an accurate OpenAPI spec into openApiConf for a REST surface — prefer a spec the running app serves, suggest the code/build change that makes the framework generate one, verify it resolves against the app (base/context path), and derive…
15 11d ago A 92 tokens
original MIT
Cursor rule Cursor
HawkScan scan-planning (discovery) reference: code-first discovery of an app's API surfaces before writing or editing stackhawk.yml — reading repo docs first, per-framework route inventory, recommending code changes for structural gaps, asking the user instead of guessing, and producing a per-surface stackhawk.yml…
15 11d ago A 88 tokens
original MIT
Cursor rule Cursor
HawkScan scan-quality (post-scan quality gate) reference: run after every scan and rescan, before findings become fix tasks. Derives a fresh coverage expectation each run (spec-wired or route-inventory), the four coverage checks, and a bounded, additive-only stackhawk.yml config iteration to close gaps — never blocks…
15 11d ago A 76 tokens
original MIT
Cursor rule Cursor
HawkScan DAST security scanning. Use when the user asks to run or perform a security or DAST scan, to test an app or API for vulnerabilities, or to verify a vulnerability is fixed — and proactively right after you complete a code change (feature, bugfix, refactor); "done" means "done and secure" (configure, scan, fix…
15 11d ago A 6,655 tokens
original MIT
Cursor rule Cursor
Optimize hawk op CLI contract: policy list/get/create/delete/assign and scan metrics commands the skill orchestrates, with flags and JSON output notes. The skill consumes these; it does not recompute metrics.
15 11d ago A 42 tokens
original MIT
Cursor rule Cursor
Optimize codebase-to-config mapping: tech-flag detection heuristics (reuses hawkscan's evidence-file detection), plugin selection from a base preset, stackhawk.yml correctness (app type, OpenAPI, GraphQL, auth), and the default-balanced speed-vs-coverage profile lean.
15 11d ago A 59 tokens
original MIT
Cursor rule Cursor
Optimize post-scan metrics refine loop: MetricsJson schema (paths/operations/flags/health), flag-to-lever mapping (concurrency for rate-limited/timeout-prone; excludePaths for heavy/slow paths; auth for auth-wall), auto-vs-confirm tiers, concurrency step-down (halve from current, floor 1), and the capped refine loop.
15 11d ago A 74 tokens
original MIT
Cursor rule Cursor
Optimize trial lifecycle: how a named scan policy reaches a scan via S3 download (non-destructive), deterministic OPTIMIZETRIAL naming, crash-safe create/promote/discard sequences (orphan-policy and backup-file guards, reconstruct from the live policy), and failure handling.
15 11d ago A 62 tokens
original MIT