stackhawk-api — 1 skill

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-19

Run UTC: 2026-10-19T21:10:55Z
Reviewed: 2026-10-19
Published: 2026-10-19
Updated: 2026-10-19

Observations · Limitations · Evidence

Works with:

Works with Claude Code

Works with Codex

Works with Gemini CLI

Works with Grok Build

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 1 skill declaration. Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · skills · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-19T21:10:55Z, tree 6d668898740ee503900b274e76a1831e7a67350b387ab95c9808e16903f1c8c0.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: stackhawk-api — 1 skill
slug: source-skills-0620e73eb86c08e424379653
type: skills
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 1 skill declaration. Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared skill names (listing.json): api"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/stackhawk/agent-skills.git
documentation url: https://github.com/stackhawk/agent-skills.git
commit: d0eea864c42f7c2e872334bb3df424daa1fbaadc
tree sha256: 6d668898740ee503900b274e76a1831e7a67350b387ab95c9808e16903f1c8c0
file sha256: {"plugins/api/.claude-plugin/icon.svg":"b9daa200838cd7a6985a63341beaa192917621de67416012cb5d8bb46ce454a2","plugins/api/.claude-plugin/plugin.json":"61fdbf5541b2a947607a4e8e07ab9d518085a81658a21233a47a558340d4e4ac","plugins/api/.codex-plugin/plugin.json":"fefc808f2a8dff1729f1aa157c6159f3c6da3086ab2ec261dbf13475cc6d2e33","plugins/api/README.md":"22221a0a198f00a77fb3bab87e1c1a64d05fd92c52122b0e41dda88788b78a97","plugins/api/skills/api/SKILL.md":"9f178a0eef141f9ebed3b3b3bfe8f5b9e08df71eb0a669e0a3070a4288214a61","plugins/api/skills/api/references/hawk-op-shortcuts.md":"cba9177522fc51d3ede7d91ea19f1121f05b9291f96db0d4762d6d3b718e1513","plugins/api/skills/api/references/reporting-recipes.md":"48262e58b5b527c68b020a82c8b61f528c3fb5daf2a195c9967d548f4ae212d1"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-19T21:10:55Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-19
reviewed date: 2026-10-19
published date: 2026-10-19
modified date: 2026-10-19
reviewer: Machine-checked
harness version: toolwitness harness at commit c2f903d8a014d7d191e486068c85924c63e43903
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-19T21:10:55Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"stackhawk-api — 1 skill","operatingSystem":"Not exercised","softwareVersion":"d0eea864c42f7c2e872334bb3df424daa1fbaadc"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 1 skill declaration. Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared skill names (listing.json): api"}],"evidence_sha256":{"LOCK.json":"292339c822fafc01f29c931397d989fd51eb86359145b5f4709072eadb0e09d1","commands.json":"c453f44ea7d23ccd2d4ed869d958bf21fdb799470ad264fdea184e62eb9d876f","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"526ed8e0826c0befb6e9a3c9eb13c983d9bf6304b64387bae8ba7b153a493e38","listing.json":"a0fa9656e9a7b498f03ec1c29e736ef7937b75f7b0c71c4d687486efe75d9314","selection.json":"0ee6cf5e2f4ac80ffc4bfc9e72e290a9fb8ed9071f6f87aa9ccbfb1f0280b786"},"identity_artifact":"identity.json"}
review: {"codex":"dbeba31337b76cec76e533545bdd1a61926a945a467b356558c8ac4cdd0a7265","date":"2026-10-19","gates":"63a479a7fefe1bb69e03bb3f9dbf585733d44fe928acb9afa5a6f62753c016a9","grok":"9dc06163b5386d26667648d22f31f87f0005e86c2f902ad59ebf7ed67c9a7389","kind":"machine-checked","reviewed_sha256":"740bc914f42610ed275e0e06e1000bd1432271b271c4f5afb439db8e5426c8ed","summary":"Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 12 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "plugins/api/skills/api/SKILL.md",
        "name": "api",
        "description": "Use this skill when a user or agent needs to query the StackHawk platform for security reporting, findings analysis, or app management. Triggers include: \"stackhawk api\", \"security posture\", \"findings report\", \"show me findings\", \"untriaged findings\", \"which apps\", \"scan history\", \"security dashboard\", \"triage\", \"what needs attention\". Uses the hawk CLI (`hawk op` subcommand) for all platform queries. Do NOT use for running scans (use the hawkscan skill for \"scan my app\", \"hawkscan\", \"stackhawk.yml\", \"DAST\") or for fixing/remediating code or vulnerabilities — this skill only reads and reports platform data.\n",
        "files": {
          "plugins/api/skills/api/SKILL.md": "9f178a0eef141f9ebed3b3b3bfe8f5b9e08df71eb0a669e0a3070a4288214a61",
          "plugins/api/skills/api/references/hawk-op-shortcuts.md": "cba9177522fc51d3ede7d91ea19f1121f05b9291f96db0d4762d6d3b718e1513",
          "plugins/api/skills/api/references/reporting-recipes.md": "48262e58b5b527c68b020a82c8b61f528c3fb5daf2a195c9967d548f4ae212d1"
        }
      }
    ],
    "hooks": [],
    "executions": []
  }
}

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-19