Cursor
Install (Recommended)
Install StackHawk rules to your global Cursor config so they’re available in every project:
# Clone the agent-skills repo
git clone https://github.com/stackhawk/agent-skills.git /tmp/stackhawk-skills
# Install Cursor rules to your global config
bash /tmp/stackhawk-skills/scripts/install.sh --platform cursor --target ~
# Clean up
rm -rf /tmp/stackhawk-skills# Clone the agent-skills repo
git clone https://github.com/stackhawk/agent-skills.git $env:TEMP\stackhawk-skills
# Install Cursor rules to your global config
& "$env:TEMP\stackhawk-skills\scripts\install.ps1" -Platform cursor
# Clean up
Remove-Item -Recurse -Force "$env:TEMP\stackhawk-skills"CMD users: use PowerShell (built into Windows 10+) or WSL.
Global rules in ~/.cursor/rules/ are loaded automatically in every project you open.
Install the hawk CLI
The hawk CLI is a single self-contained binary — hawkop is now bundled in as hawk op, and no separate Java install is required.
brew tap stackhawk/cli && brew trust stackhawk/cli && brew install hawkInstall hawk with the hawk CLI install script (not the agent-skills install.sh above), then add it to your PATH:
curl -fsSL https://download.stackhawk.com/hawk/install.sh | sh
export PATH="$HOME/.hawk/bin:$PATH"Download and run the hawk.exe MSI installer from the downloads page — self-contained, no Java required. Or install hawk for your user only, with no administrator access, using the hawk CLI install script:
irm https://download.stackhawk.com/hawk/install.ps1 | iex
$env:Path = "$env:USERPROFILE\.hawk\bin;$env:Path"CMD users: run the cmd.exe version of the install script instead:
curl -fsSL -o "%TEMP%\hawk-install.bat" https://download.stackhawk.com/hawk/install.bat && call "%TEMP%\hawk-install.bat"
set "PATH=%USERPROFILE%\.hawk\bin;%PATH%"Then authenticate:
hawk init --browserhawk init --browser opens your browser to approve access, then provisions and saves your API key automatically — no copy/paste. (On Windows, run hawk.exe init --browser.) Prefer to manage keys yourself? Create one at app.stackhawk.com → Settings → API Keys.
Verify
Open any project in Cursor. Ask the AI: “What StackHawk rules do you have?” It should describe the StackHawk capabilities — HawkScan scanning, API reporting, and more.
Usage
Ask Cursor’s AI to scan your application:
Scan my app running on localhost:8080 for security vulnerabilities. Explain each step you take and each decision you make along the way.Tips
- Install once, scan everywhere: Global rules in
~/.cursor/rules/work across all projects - The rules are split into 10 modular files so Cursor loads only what’s relevant for the current task
- The agent checks if your app is running and will prompt you to start it if needed