GitHub Copilot | StackHawk Documentation

Install

copilot plugin marketplace add stackhawk/agent-skills-marketplace
copilot plugin install wingman@stackhawk

wingman is the StackHawk umbrella plugin — one install pulls the full skill set (hawkscan, stackhawk-api, data-seed, optimize). GitHub Copilot has no plugin-dependency mechanism, so wingman ships these four skills as bundled copies rather than resolving them as dependencies. To also install hawkscan-ci, add it separately with copilot plugin install hawkscan-ci@stackhawk.

Install the hawk CLI

The hawk CLI is a single self-contained binary — hawkop is now bundled in as hawk op, and no separate Java install is required.

brew tap stackhawk/cli && brew trust stackhawk/cli && brew install hawk

Download the self-contained hawk binary from the downloads page.

Download and run the hawk.exe MSI installer from the downloads page — self-contained, no Java required.

CMD users: use PowerShell (built into Windows 10+) or WSL.

Then authenticate:

hawk init --browser

hawk init --browser opens your browser to approve access, then provisions and saves your API key automatically — no copy/paste. (On Windows, run hawk.exe init --browser.) Prefer to manage keys yourself? Create one at app.stackhawk.com → Settings → API Keys.

Verify

Check your directory structure — after installing the umbrella, you should see its skills:

~/.copilot/installed-plugins/stackhawk/wingman/
└── copilot-skills/
    ├── hawkscan/
    ├── stackhawk-api/
    ├── stackhawk-data-seed/
    └── stackhawk-optimize/

In VS Code: Open GitHub Copilot → Configure Skills. The hawkscan, stackhawk-api, stackhawk-data-seed, and stackhawk-optimize skills should appear in the list.

Ask Copilot: "What StackHawk skills do you have?" — the response should mention the StackHawk skills: HawkScan scanning, API reporting, and more.

Model recommendation: Claude Sonnet 4.5+ and Opus perform well with multi-step security scanning workflows — app creation, auth configuration, and fix loops. GPT-4o and GPT-4.1 have shown less reliable results in our testing. If Claude is available through your Copilot subscription, select it for security scanning tasks.

Usage

Ask Copilot to scan your application:

Scan my app running on localhost:8080 for security vulnerabilities. Explain each step you take and each decision you make along the way.

Tips

Install once, scan everywhere: Plugins installed via copilot plugin install live in ~/.copilot/installed-plugins/ and are available across all your projects
Multi-tool support: the same marketplace catalog serves Copilot, Claude Code, and Codex — see Marketplace vs. Plugin Repo
Team distribution: For team-wide rollout, add skills to .github/skills/ in your repos
Custom locations: Configure additional project-skill directories via the chat.agentSkillsLocations setting in VS Code
The agent checks if your app is running and will prompt you to start it if needed