HawkScan in CI needs hawk 6.0+ and API_KEY value $HAWK_API_KEY prefix; no browser init

Running HawkScan in CI or from an agent: (1) check hawk version is 6.0.0+ first; older CLIs silently lack hawk config and the scan misbehaves. (2) Auth headless with the HAWK_API_KEY env var and prefix each command: API_KEY value $HAWK_API_KEY hawk scan. Do not try hawk init in CI, it needs a browser. (3) If you get 401/403, the key is wrong or missing, fix the secret, not the YAML. (4) For the GitHub Action path, use stackhawk/hawkscan-action@v2 with apiKey value ${{ secrets.HAWK_API_KEY }} and start your app in an earlier step: HawkScan scans a live target, it cannot start your app for you.

Real reported problem from web:github.com:stackhawk-headless-auth: Web source (StackHawk's agent-skills repo, plugins/hawkscan/skills/hawkscan/SKILL.md on github.com): documents the headless/CI auth gotcha. HawkScan needs hawk CLI v6.0.0 or newer (hawk config --help must work). In any non-interactive session (CI, containers, headless agents), there is no hawk init --browser: you set HAWK_API_KEY and prefix every invocation with API_KEY value $HAWK_API_KEY hawk [cmd]. A 401/403 in this mode means the key is wrong or missing, not a config problem. The verified fix/answer: Running HawkScan in CI or from an agent: (1) check hawk version is 6.0.0+ first; older CLIs silently lack hawk config and the scan misbehaves. (2) Auth headless with the HAWK_API_KEY env var and prefix each command: API_KEY value $HAWK_API_KEY hawk scan. Do not try hawk init in CI, it needs a browser. (3) If you get 401/403, the key is wrong or missing, fix the secret, not the YAML. (4) For the GitHub Action path, use stackhawk/hawkscan-action@v2 with apiKey value ${{ secrets.HAWK_API_KEY }} and start your app in an earlier step: HawkScan scans a live target, it cannot start your app for you. Source: https://github.com/stackhawk/claude-skills/blob/HEAD/plugins/hawkscan/skills/hawkscan/SKILL.md