GitHub Copilot

GitHub Copilot

GitHub Copilot auto-discovers agent skills from standard directories in your user profile or project. Install the StackHawk skills once and they’re available across every project you work on.

Install (Recommended)

Install StackHawk skills to your user profile so they’re available in every project:

# Clone the skills repo
git clone https://github.com/stackhawk/agent-skills.git /tmp/stackhawk-skills

# Copy to your personal skills directory
mkdir -p ~/.copilot/skills
cp -r /tmp/stackhawk-skills/skills/* ~/.copilot/skills/

# Clean up
rm -rf /tmp/stackhawk-skills

Personal skills are also discovered from ~/.agents/skills/ and ~/.claude/skills/ — use ~/.claude/skills/ if you also use Claude Code so both tools share the same skills.

Install — Per-Project (Alternative)

If you want to distribute skills to a team via a specific repo, add them to the project instead:

mkdir -p .github/skills
cp -r /tmp/stackhawk-skills/skills/* .github/skills/
git add .github/skills
git commit -m "feat: add StackHawk DAST agent skills"

Copilot discovers project skills from .github/skills/, .agents/skills/, and .claude/skills/.

Set Your API Key

export HAWK_API_KEY=hawk.xxxxxxxxxxxxxxxxxxxx

Verify

In VS Code with Copilot, open the Configure Skills menu to confirm the StackHawk skills are discovered. You can also ask Copilot: “What StackHawk skills do you have?”

Usage

Ask Copilot to scan your application:

Scan my app running on localhost:8080 for security vulnerabilities

Tips

Install once, scan everywhere: Personal skills in ~/.copilot/skills/ are available across all your projects
Multi-tool support: Use ~/.claude/skills/ instead if you also use Claude Code — both tools discover from the same directory
Team distribution: For team-wide rollout, add skills to .github/skills/ in your repos
Custom locations: Configure additional skill directories via the chat.skillsLocations setting in VS Code
The agent checks if your app is running and will prompt you to start it if needed