GitHub Copilot

Install

copilot plugin marketplace add stackhawk/agent-skills-marketplace
copilot plugin install wingman@stackhawk

wingman is the StackHawk umbrella plugin — one install pulls the full skill set (hawkscan, stackhawk-api, data-seed, optimize). GitHub Copilot has no plugin-dependency mechanism, so wingman ships these four skills as bundled copies rather than resolving them as dependencies. To also install hawkscan-ci, add it separately with copilot plugin install hawkscan-ci@stackhawk.

Install the hawk CLI

The hawk CLI is a single self-contained binary — hawkop is now bundled in as hawk op, and no separate Java install is required.

brew tap stackhawk/cli && brew trust stackhawk/cli && brew install hawk

Then authenticate:

hawk init --browser

hawk init --browser opens your browser to approve access, then provisions and saves your API key automatically — no copy/paste. (On Windows, run hawk.exe init --browser.) Prefer to manage keys yourself? Create one at app.stackhawk.com → Settings → API Keys.

Verify

Check your directory structure — after installing the umbrella, you should see its skills:

~/.copilot/installed-plugins/stackhawk/wingman/
└── copilot-skills/
    ├── hawkscan/
    ├── stackhawk-api/
    ├── stackhawk-data-seed/
    └── stackhawk-optimize/

In VS Code: Open GitHub Copilot → Configure Skills. The hawkscan, stackhawk-api, stackhawk-data-seed, and stackhawk-optimize skills should appear in the list.

Ask Copilot: "What StackHawk skills do you have?" — the response should mention the StackHawk skills: HawkScan scanning, API reporting, and more.

Usage

Ask Copilot to scan your application:

Scan my app running on localhost:8080 for security vulnerabilities

Tips

• Install once, scan everywhere: Plugins installed via copilot plugin install live in ~/.copilot/installed-plugins/ and are available across all your projects
• Multi-tool support: the same marketplace catalog serves Copilot, Claude Code, and Codex — see Marketplace vs. Plugin Repo
• Team distribution: For team-wide rollout, add skills to .github/skills/ in your repos
• Custom locations: Configure additional project-skill directories via the chat.agentSkillsLocations setting in VS Code
• The agent checks if your app is running and will prompt you to start it if needed