{
  "name": "stackhawk-api — 1 skill",
  "slug": "source-skills-0620e73eb86c08e424379653",
  "type": "skills",
  "category": "developer-tools",
  "example": false,
  "evidence_state": "pinned_source_listing",
  "stamp": "Pinned source listing — machine-checked",
  "summary": "Pinned source declarations and file hashes were listed.",
  "outcome": "Listed 1 skill declaration. Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
  "rule_results": [
    "The retained source tree matches its acquisition manifest.",
    "Declared skill names (listing.json): api"
  ],
  "task": "What declarations and files are present in this pinned source?",
  "setup": "Git blob acquisition followed by static source inspection.",
  "limitations": "Scope: acquisition and static inspection. Command results: commands.json.",
  "source_url": "https://github.com/stackhawk/agent-skills.git",
  "documentation_url": "https://github.com/stackhawk/agent-skills.git",
  "commit": "d0eea864c42f7c2e872334bb3df424daa1fbaadc",
  "tree_sha256": "6d668898740ee503900b274e76a1831e7a67350b387ab95c9808e16903f1c8c0",
  "file_sha256": {
    "plugins/api/.claude-plugin/icon.svg": "b9daa200838cd7a6985a63341beaa192917621de67416012cb5d8bb46ce454a2",
    "plugins/api/.claude-plugin/plugin.json": "61fdbf5541b2a947607a4e8e07ab9d518085a81658a21233a47a558340d4e4ac",
    "plugins/api/.codex-plugin/plugin.json": "fefc808f2a8dff1729f1aa157c6159f3c6da3086ab2ec261dbf13475cc6d2e33",
    "plugins/api/README.md": "22221a0a198f00a77fb3bab87e1c1a64d05fd92c52122b0e41dda88788b78a97",
    "plugins/api/skills/api/SKILL.md": "9f178a0eef141f9ebed3b3b3bfe8f5b9e08df71eb0a669e0a3070a4288214a61",
    "plugins/api/skills/api/references/hawk-op-shortcuts.md": "cba9177522fc51d3ede7d91ea19f1121f05b9291f96db0d4762d6d3b718e1513",
    "plugins/api/skills/api/references/reporting-recipes.md": "48262e58b5b527c68b020a82c8b61f528c3fb5daf2a195c9967d548f4ae212d1"
  },
  "lockfiles": [
    "LOCK.json"
  ],
  "utc_date": "2026-10-19T21:10:55Z",
  "source_date": "2026-10-16",
  "discovered_date": "2026-10-16",
  "retested_date": "2026-10-19",
  "reviewed_date": "2026-10-19",
  "published_date": "2026-10-19",
  "modified_date": "2026-10-19",
  "reviewer": "machine pipeline",
  "harness_version": "toolwitness harness at commit c2f903d8a014d7d191e486068c85924c63e43903",
  "claude_code_version": "Not applicable: static source inspection (commands.json).",
  "model_id": "Not applicable: static source inspection (commands.json).",
  "scanner_version": "Not applicable: static source inspection.",
  "rulepack_version": "Not applicable: static source inspection.",
  "agents": [],
  "disclaimer": "This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.",
  "commands": [
    "Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."
  ],
  "prompt_list": [
    "Not applicable: static source inspection (commands.json)."
  ],
  "history": [
    "2026-10-19T21:10:55Z: pinned source inspection"
  ],
  "application": {
    "name": "stackhawk-api — 1 skill",
    "softwareVersion": "d0eea864c42f7c2e872334bb3df424daa1fbaadc",
    "applicationCategory": "DeveloperApplication",
    "operatingSystem": "Not exercised"
  },
  "artifacts": {
    "transcript": "Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
    "sinkhole_log": "Not applicable: static source inspection (commands.json).",
    "canary_log": "Not applicable: static source inspection (commands.json).",
    "scanner_output": "Not applicable: static source inspection (commands.json).",
    "normalized_text": "{\n  \"listing\": {\n    \"skills\": [\n      {\n        \"path\": \"plugins/api/skills/api/SKILL.md\",\n        \"name\": \"api\",\n        \"description\": \"Use this skill when a user or agent needs to query the StackHawk platform for security reporting, findings analysis, or app management. Triggers include: \\\"stackhawk api\\\", \\\"security posture\\\", \\\"findings report\\\", \\\"show me findings\\\", \\\"untriaged findings\\\", \\\"which apps\\\", \\\"scan history\\\", \\\"security dashboard\\\", \\\"triage\\\", \\\"what needs attention\\\". Uses the hawk CLI (`hawk op` subcommand) for all platform queries. Do NOT use for running scans (use the hawkscan skill for \\\"scan my app\\\", \\\"hawkscan\\\", \\\"stackhawk.yml\\\", \\\"DAST\\\") or for fixing/remediating code or vulnerabilities — this skill only reads and reports platform data.\\n\",\n        \"files\": {\n          \"plugins/api/skills/api/SKILL.md\": \"9f178a0eef141f9ebed3b3b3bfe8f5b9e08df71eb0a669e0a3070a4288214a61\",\n          \"plugins/api/skills/api/references/hawk-op-shortcuts.md\": \"cba9177522fc51d3ede7d91ea19f1121f05b9291f96db0d4762d6d3b718e1513\",\n          \"plugins/api/skills/api/references/reporting-recipes.md\": \"48262e58b5b527c68b020a82c8b61f528c3fb5daf2a195c9967d548f4ae212d1\"\n        }\n      }\n    ],\n    \"hooks\": [],\n    \"executions\": []\n  }\n}"
  },
  "review_input": {
    "identity_artifact": "identity.json",
    "evidence_sha256": {
      "LOCK.json": "292339c822fafc01f29c931397d989fd51eb86359145b5f4709072eadb0e09d1",
      "commands.json": "c453f44ea7d23ccd2d4ed869d958bf21fdb799470ad264fdea184e62eb9d876f",
      "complete.json": "91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f",
      "identity.json": "526ed8e0826c0befb6e9a3c9eb13c983d9bf6304b64387bae8ba7b153a493e38",
      "listing.json": "a0fa9656e9a7b498f03ec1c29e736ef7937b75f7b0c71c4d687486efe75d9314",
      "selection.json": "0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"
    },
    "claims": [
      {
        "id": "acquired",
        "field": "summary",
        "text": "Pinned source declarations and file hashes were listed.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "listed",
        "field": "outcome",
        "text": "Listed 1 skill declaration. Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "tree",
        "field": "rule_results.0",
        "text": "The retained source tree matches its acquisition manifest.",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      },
      {
        "id": "declared",
        "field": "rule_results.1",
        "text": "Declared skill names (listing.json): api",
        "sources": [
          "LOCK.json",
          "listing.json",
          "commands.json"
        ]
      }
    ]
  },
  "review": {
    "kind": "machine-checked",
    "date": "2026-10-19",
    "reviewed_sha256": "740bc914f42610ed275e0e06e1000bd1432271b271c4f5afb439db8e5426c8ed",
    "gates": "63a479a7fefe1bb69e03bb3f9dbf585733d44fe928acb9afa5a6f62753c016a9",
    "codex": "dbeba31337b76cec76e533545bdd1a61926a945a467b356558c8ac4cdd0a7265",
    "grok": "9dc06163b5386d26667648d22f31f87f0005e86c2f902ad59ebf7ed67c9a7389",
    "summary": "Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."
  }
}