---
title: "Agent Skills"
description: "Install StackHawk agent skills to give your AI coding agent runtime security scanning, vulnerability fixing, and security reporting capabilities."
url: https://docs.stackhawk.com/ai-security/agent-skills/
---

# Agent Skills

StackHawk agent skills are instruction sets that teach AI coding agents how to run security scans, parse findings, fix vulnerabilities, and verify fixes. Install a skill and your agent gains full runtime security testing capability — no separate tools, no context switching.

## How Agent Skills Work

When you install a StackHawk agent skill, your AI coding agent learns how to:

1. **Configure** — Generate a `stackhawk.yml` config file based on your app type, host, and auth pattern
2. **Scan** — Run HawkScan against your running application
3. **Parse** — Read structured JSON findings with vulnerability type, severity, affected path, and method
4. **Fix** — Remediate vulnerabilities directly in your codebase (parameterized queries, output encoding, security headers, etc.)
5. **Verify** — Rescan to confirm all fixes are effective

When you finish building a feature, the agent automatically runs this loop — “done” means “done and secure.”

## Supported Agents

- [Claude Code](https://docs.stackhawk.com/ai-security/agent-skills/claude-code/): Install with one command from the plugin marketplace.
- [Cursor](https://docs.stackhawk.com/ai-security/agent-skills/cursor/): Copy rule files into your project's .cursor/rules/ directory.
- [Codex](https://docs.stackhawk.com/ai-security/agent-skills/codex/): Install with one command from the plugin marketplace.
- [Antigravity](https://docs.stackhawk.com/ai-security/agent-skills/agy/): Install with one command from the plugin registry.
- [GitHub Copilot](https://docs.stackhawk.com/ai-security/agent-skills/copilot/): Install with one command from the plugin marketplace.

## Prerequisites

- An AI coding agent
- A StackHawk account ([Secure](https://www.stackhawk.com/pricing), [Scale](https://www.stackhawk.com/pricing), or [Wingman](https://auth.stackhawk.com/wingman))
- The `hawk` CLI **v6.0.0 or later** — a single self-contained binary. See [Install and Run HawkScan](https://docs.stackhawk.com/getting-started/install-and-run/) or the [downloads page](https://docs.stackhawk.com/downloads/hawkscan/). Verify with `hawk version`.
- Authentication via `hawk init --browser`, which opens your browser and provisions your API key automatically (or generate one at [app.stackhawk.com](https://app.stackhawk.com) → Settings → API Keys).
- An application running locally that the scanner can reach, plus its source code so the agent can fix what it finds.

## Agent Skills Overview

Follow the steps for your agent under [Supported Agents](#supported-agents) above to enable the full StackHawk skill set in your AI coding agent:

| Skill | Purpose |
| - | - |
| **HawkScan** | Configure, run, and interpret security scans. Fix vulnerabilities and verify fixes. |
| **StackHawk API** | Query the StackHawk platform for security posture, findings reports, scan history, and triage status. |
| **Data Seed** | Seed checked-in test data so authenticated scans can reach non-trivial application paths. |
| **Optimize** | Analyze a codebase and produce an optimal HawkScan setup (tech flags, scan policy, `stackhawk.yml`). |

On the plugin-based agents (Claude Code, Codex, GitHub Copilot), a single install of the **`wingman`** plugin pulls in all four, so you don’t install them one by one. On Claude Code and Codex it resolves the others as dependencies; on GitHub Copilot, which has no dependency mechanism, it ships them as bundled copies. Cursor and Antigravity install the same set directly from the [`stackhawk/agent-skills`](https://github.com/stackhawk/agent-skills) repo. See [Marketplace vs. Plugin Repo](#marketplace-vs-plugin-repo) below for how installs are pinned and updated.

## Marketplace vs. Plugin Repo

For plugin-based agents (Claude Code, Codex, GitHub Copilot), you install from the **marketplace catalog**, not directly from the source repo. There are two distinct repositories:

| Repository | What it is | What you do with it |
| - | - | - |
| [`stackhawk/agent-skills-marketplace`](https://github.com/stackhawk/agent-skills-marketplace) | The curated **catalog** — a manifest that points the `wingman` umbrella (and each underlying plugin) at a pinned, tested release. | This is what you `marketplace add`. It pins you to a tested **GA release** (StackHawk advances the pin as new versions ship) rather than the latest `main`. |
| [`stackhawk/agent-skills`](https://github.com/stackhawk/agent-skills) | The **source code** — the actual skill definitions, scripts, and rule files. | Browse it to read the skills, file issues, or contribute. Cursor and Antigravity install directly from here (see below). |

In short: the marketplace is *what you install*; the agent-skills repo is *what it’s built from*.

Cursor and Antigravity don’t use the StackHawk marketplace — Cursor copies rule files directly from `stackhawk/agent-skills`, and Antigravity (`agy`) installs the plugin directly from the `stackhawk/agent-skills` GitHub URL. Their install pages reflect this.

## How to Update

Installing from the marketplace pins you to StackHawk’s **current GA release** — a stable, tested version, not the latest in-development `main`. You’re never auto-pushed unreleased changes.

When StackHawk publishes a new GA version, the catalog is re-pinned to it — so updates follow our release cadence, not every incubating commit. The pin lives in the marketplace catalog, so to move up you refresh the catalog and then update the plugin with your agent’s own update command (no reinstall):

- **Claude Code** — `/plugin marketplace update stackhawk`, then `/plugin update wingman`
- **GitHub Copilot** — `copilot plugin marketplace update`, then `copilot plugin update wingman@stackhawk`
- **Codex** — `codex plugin marketplace upgrade` (Codex has no per-plugin update command; re-run `codex plugin add wingman@stackhawk` to pull the refreshed pin)

Watch the [marketplace release log](https://github.com/stackhawk/agent-skills-marketplace/releases) to see when a new version ships and what changed.

Cursor and Antigravity install directly from `stackhawk/agent-skills` (not the marketplace), so they track `main` — re-run their install commands to pull the latest.