GitHub Copilot
Install
copilot plugin marketplace add stackhawk/agent-skills
copilot plugin install hawkscan@stackhawk
copilot plugin install stackhawk-api@stackhawkInstall hawk and hawkop
brew tap stackhawk/cli && brew install hawk hawkopDownload and run the installers from docs.stackhawk.com/downloads:
- hawk — Windows MSI (includes bundled Java)
- hawkop — Windows MSI
CMD users: use PowerShell (built into Windows 10+) or WSL.
Then authenticate both CLIs:
hawk init
hawkop inithawk init prompts for your API key (hawk.xxxxxxxxxx.xxxxxxxxxx) — get one at app.stackhawk.com → Settings → API Keys. hawkop init picks up the key automatically and prompts for your default organization.
Verify
Check your directory structure — after install, you should see:
~/.agents/skills/
├── hawkscan/
│ ├── SKILL.md
│ └── references/
└── stackhawk-api/
├── SKILL.md
└── references/In VS Code: Open GitHub Copilot → Configure Skills. Both hawkscan and stackhawk-api should appear in the list.
Ask Copilot: "What StackHawk skills do you have?" — the response should mention both the HawkScan security scanning skill and the StackHawk API skill.
Model recommendation: Claude Sonnet 4.5+ and Opus perform well with multi-step security scanning workflows — app creation, auth configuration, and fix loops. GPT-4o and GPT-4.1 have shown less reliable results in our testing. If Claude is available through your Copilot subscription, select it for security scanning tasks.
Usage
Ask Copilot to scan your application:
Scan my app running on localhost:8080 for security vulnerabilitiesTips
- Install once, scan everywhere: Personal skills in
~/.agents/skills/are available across all your projects - Multi-tool support:
~/.agents/skills/works across Copilot, Claude Code, and other tools that follow the shared agents convention - Team distribution: For team-wide rollout, add skills to
.github/skills/in your repos - Custom locations: Configure additional skill directories via the
chat.skillsLocationssetting in VS Code - The agent checks if your app is running and will prompt you to start it if needed