StackHawk HawkScan

Claude Code: /plugin marketplace add anthropics/claude-plugins-official → /plugin install stackhawk-hawkscan@claude-plugins-official

The gap it targets is specific: an agent writes an endpoint and nothing checks whether that endpoint is exploitable on the app that is actually running. The main skill generates the stackhawk.yml, launches the scanner through the CLI or Docker, parses the results into prioritized remediation tasks, then rescans to confirm the fix held — a loop rather than a report. Separate skills query the platform API for posture across applications, graduate a working local scan into CI by detecting the provider and patching the workflow file, and seed test data so authenticated paths get scanned instead of bouncing off a login screen. Hooks fire on session start, skill activation and post-commit, so scanning is attached to the workflow rather than remembered.