Skills that configure and run HawkScan DAST against your running app, turn findings into fix tasks, and rescan.

How it works

Foe: Breach Spider, a security hole an attacker could use.

Foes

  • Breach Spider

Party · Context

  • RogueYour agent100/100
  1. Breach Spider

    The Breach Spider blocks the way.

    What really happensIt stands for a security hole an attacker could use.

    Rogue: Context 100/100.

  2. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.

  3. StackHawk Agent Skills

    The hawk is unhooded with a key from StackHawk.

    What really happensSet HAWK_API_KEY, add the stackhawk marketplace and install wingman. Scan only apps you own or are authorized to test.

    Breach Spider takes 17.

  4. StackHawk Agent Skills

    The hunting ground is marked out on a map.

    What really happenshawkscan writes a stackhawk.yml config for your app. stackhawk-data-seed can generate seed data so scans reach deeper paths.

    Breach Spider takes 21.

  5. Exploit

    The Breach Spider uses Exploit.

    Rogue takes 11. Rogue: Context 78/100.

  6. StackHawk Agent Skills

    The hawk dives at the live gates.

    What really happensHawkScan runs DAST against your running app through the CLI or Docker, and the agent parses the findings.

    Breach Spider takes 34.

  7. StackHawk Agent Skills

    Each wound is bound, and the hawk flies the route again.

    What really happensFindings become prioritized fix tasks. After the fix, the agent re-scans to confirm it worked.

    Breach Spider takes 28. Breach Spider falls.

  8. Victory

    The Breach Spider falls.

Learn this spell

Claude Code

/plugin marketplace add stackhawk/agent-skills
/plugin install wingman@stackhawk

Codex

codex plugin marketplace add stackhawk/agent-skills-marketplace
codex plugin add hawkscan@stackhawk

Notes

Needs a StackHawk account and HAWK_API_KEY; the README offers a 14-day free trial. wingman installs hawkscan, stackhawk-api, stackhawk-data-seed and stackhawk-optimize; the hawkscan plugin's hooks can start a scan after code changes. hawkscan-ci installs separately and writes CI workflow files. For Codex the README gives codex plugin marketplace add stackhawk/agent-skills-marketplace, then codex plugin add hawkscan@stackhawk. HawkScan attacks a live app, so run it only against apps you own or are authorized to test.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.