A powerful DAST integration for automating security testing and vulnerability management within AI-driven developer workflows.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install stackhawk
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install stackhawk using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is StackHawk?
The StackHawk integration for Openclaw Skills empowers developers to bridge the gap between AI coding agents and Dynamic Application Security Testing (DAST). By leveraging this skill, agents can find, triage, and fix application vulnerabilities early in the software development lifecycle. It provides a standardized interface to interact with StackHawk data, ensuring security is baked into the CI/CD pipeline without manual overhead.
Built on the Membrane framework, this skill abstracts away the complexities of authentication and API management. It allows Openclaw Skills to interact with Organizations, Applications, and Scans through a secure, proxy-based architecture that handles credential refreshing and protocol normalization automatically.
StackHawk Use Cases
- Automating DAST scans during the development phase to catch vulnerabilities early.
- Triaging security findings by programmatically retrieving scan results and metadata.
- Managing application security profiles and organizational scan data through AI agents.
- Integrating security testing checkpoints into automated CI/CD pipeline workflows.
- Investigating specific vulnerability impacts using direct API proxy requests.
How StackHawk Works
- CLI Initialization: The user installs the Membrane CLI to facilitate communication between the local environment and the StackHawk integration.
- Authentication: A secure session is established using the login command, supporting both interactive and headless environments.
- Connection Establishment: A connection is created or verified using a URL or domain, which Openclaw Skills use to map to specific StackHawk instances.
- Action Discovery: The agent uses natural language intent strings to search for specific StackHawk actions like listing scans or retrieving organization details.
- Execution & Proxying: The agent runs structured actions for common tasks or uses the transparent proxy to send authenticated raw requests to the StackHawk API.
StackHawk Setup
First, install the Membrane CLI globally:
npm install -g @membranehq/cli@latest
Authenticate your agent (e.g., for Openclaw Skills):
membrane login --tenant --clientName=openclaw
Connect to your StackHawk instance:
membrane connection ensure "https://www.stackhawk.com/" --json
If the state is BUILDING, wait for completion:
npx @membranehq/cli connection get <id> --wait --json
StackHawk Data Schema & Taxonomy
The skill organizes data hierarchically and provides structured outputs for scan results.
| Level | Description |
|---|---|
| Organization | The top-level container for all security testing data and teams. |
| Application | Specific web applications or services being tested for vulnerabilities. |
| Scan | Individual DAST execution records containing finding details and logs. |
All actions return structured JSON objects containing an output field for the primary data and a state field to track connection health.
StackHawk Advanced Features
- Natural Language Intent Mapping: Search for actions using plain English descriptions rather than strict API endpoints.
- Transparent API Proxying: Send raw HTTP requests to any StackHawk endpoint with automatic header injection and credential refresh.
- Multi-Agent Support: Compatible with various agent types including openclaw, claude, and windsurf for cross-tool synergy.
- Long-polling & State Management: Built-in mechanisms to handle asynchronous connection building and client-required actions.
- Server-side Credential Management: Ensures no local storage of API keys or sensitive tokens.
SKILL.md
Loading
Related Openclaw Skills
Scatter Graphs
A specialized tool for visualizing and interpreting the mathematical relationships and correlations between two distinct variables.
Tianshu Review Calendar
An automated scheduling tool that distributes study topics across a countdown period to create printable Markdown exam review calendars.
scar-safety
An adaptive safety system that utilizes a scar-based reflex arc to block recurring security threats instantly without requiring LLM calls.
Amazon Keyword Research Agent
A comprehensive keyword discovery and strategy engine designed to optimize Amazon listings and PPC performance through data-driven clustering and prioritization.
Qntrl Integration for AI Agents
A powerful integration for AI agents to orchestrate complex business workflows and manage Qntrl data programmatically.
AetherViz Master
AetherViz Master is an AI-driven educational architect that converts complex teaching subjects into stunning, interactive 3D and SVG-based web experiences.
Featured*
