diff-scanning-with-aws-security-agent

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: code-review, diff-scanning, git, security, validation.

What it does

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent ~/.claude/skills/diff-scanning-with-aws-security-agent

Safety box score

Grade C, moderate risk: 42 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a wrapper around local shell/AWS CLI commands that diffs a git ref, zips the workspace, and uploads artifacts to AWS Security Agent/S3 for scanning. The main risks are broad outbound transfer of repository contents and the creation/polling of remote jobs using the user's AWS credentials.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs the agent to run shell commands such as `git diff`, `zip -r`, `aws s3 cp`, `aws securityagent ...`, `openssl rand`, and `md5sum`.
Network access	3 (high)	It uploads `/tmp/source.zip` and `/tmp/diff.patch` to S3 and calls AWS Security Agent APIs, sending workspace data off-machine.
Filesystem reach	2 (moderate)	It reads `.security-agent/config.json` and writes local state and reports like `.security-agent/scans.json` and `.security-agent/findings-{scan_id}.md`, plus temp files in `/tmp`.
Secrets & credentials	2 (moderate)	The source archive covers the whole workspace except a short exclude list, so any secrets in other files can be packaged and uploaded; it also depends on the user's AWS CLI credentials.
Privilege & persistence	0 (none)	There is no `sudo`, global install, service registration, or shell/OS configuration change in the workflow.
Instruction hijack surface	0 (none)	The skill does not tell the agent to ignore safeguards, follow remote instructions, or hide actions.
Irreversible actions	2 (moderate)	It automatically creates/recreates code reviews, starts jobs, and polls every two minutes without a human check first, using the user's AWS account.
Transparency	0 (none)	The skill is plain markdown with readable commands; there are no binaries, hidden blobs, or runtime-decoded code.

Before installing

Check that `.security-agent/config.json` points to the expected AWS account/region and role.
Review the upload set in the `zip -r /tmp/source.zip .` command to confirm no secrets or personal files are present.
Run it once in a scratch clone and inspect what gets written to `.security-agent/scans.json` and `.security-agent/findings-*.md`.
Verify the AWS principal used by `aws sts get-caller-identity` has only the intended S3/Security Agent permissions.

Rated 2026-10-19 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent/SKILL.md
Branch: main
Collection: aws-agents-for-devsecops
Updated: 2026-09-19

scanning-with-aws-security-agent — Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked.
thermo-nuclear-review — Comprehensive security and correctness audit of a branch's changes.
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
remediating-with-aws-security-agent — Pull AWS Security Agent findings (penetration tests and code reviews) and drive remediation.
threat-modeling-with-aws-security-agent — Run an AWS Security Agent threat model review on spec/design documents.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.