security-scan

Name: security-scan
Author: aws-samples

37stars20forks

How to install security-scan?

aws-samples/sample-agent-skills-for-builders/security-scan

$npx -y skills add aws-samples/sample-agent-skills-for-builders --skill security-scan

Installs into the current project.

Summary

Comprehensive security and compliance scanning for AWS CDK projects. Use when running security audits, checking license compliance, scanning container vulnerabilities, or running aggregated SAST/IaC/secret analysis before deployment.

Files · 1

View on GitHub

SKILL.md

1	# Security Scan
2
3	Comprehensive AWS CDK project security and compliance scanning with multi-tool analysis.
4
5	## When to Apply
6
7	Reference this skill when:
8	- Running security audits on CDK projects
9	- Checking license compliance
10	- Scanning container images for vulnerabilities
11	- Running aggregated SAST/IaC/secret analysis (via ASH)
12	- Generating security reports for review
13
14	## How It Works
15
16	IMPORTANT: All 9 steps are mandatory. Do not skip steps regardless of time constraints.
17
18	1. Architecture Diagram - Capture system architecture
19	2. CDK Synthesis - Generate CloudFormation templates
20	3. Viperlight Scan - Code security analysis
21	4. License Check - Dependency license compliance
22	5. Trivy Scan - Container vulnerability scanning
23	6. ASH Scan - Automated Security Helper (aggregated SAST/IaC/secret scanners)
24	7. Deployment Verification - Validate deployment readiness
25	8. Summary Report - Generate findings summary
26	9. HTML Report - Create visual report
27
28	## Prerequisites
29
30	- AWS CDK project
31	- Viperlight CLI installed
32	- Trivy CLI installed
33	- ASH (Automated Security Helper) - installed via `uvx` from https://github.com/awslabs/automated-security-helper
34	- Docker (required for ASH container mode)
35
36	## Usage
37
38	```bash
39	# Run security scan
40	"Run security scan on my CDK project"
41	"Check this project for vulnerabilities"
42	"Generate security compliance report"
43	```
44
45	## Output
46
47	Results saved to `security-scan-results/{TIMESTAMP}/`:
48	- Raw scan outputs per tool
49	- `clean-results/` - Parsed findings
50	- `security-report.html` - Visual report
51
52	## Enforcement Rules
53
54	- Execute ALL scan commands (no skipping)
55	- Fix issues found (don't just comment them)
56	- Non-interactive execution only
57	- Continue pipeline on individual step failures
58
59	## References
60
61	- [Architecture Diagram](./references/architecture-diagram.md)
62	- [CDK Synthesis](./references/cdk-synthesis.md)
63	- [Viperlight Scan](./references/viperlight-scan.md)
64	- [License Check](./references/license-check.md)
65	- [Trivy Scan](./references/trivy-scan.md)
66	- [ASH Scan](./references/ash-scan.md)
67	- [Deployment Verification](./references/deployment-verification.md)
68	- [Report Generation](./references/report-generation.md)

People who liked this also viewed

6 picks

Type

security-scan

37stars20forks

View on GitHub

How to install security-scan?

aws-samples/sample-agent-skills-for-builders/security-scan

$npx -y skills add aws-samples/sample-agent-skills-for-builders --skill security-scan

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Security Scan
2
3	Comprehensive AWS CDK project security and compliance scanning with multi-tool analysis.
4
5	## When to Apply
6
7	Reference this skill when:
8	- Running security audits on CDK projects
9	- Checking license compliance
10	- Scanning container images for vulnerabilities
11	- Running aggregated SAST/IaC/secret analysis (via ASH)
12	- Generating security reports for review
13
14	## How It Works
15
16	IMPORTANT: All 9 steps are mandatory. Do not skip steps regardless of time constraints.
17
18	1. Architecture Diagram - Capture system architecture
19	2. CDK Synthesis - Generate CloudFormation templates
20	3. Viperlight Scan - Code security analysis
21	4. License Check - Dependency license compliance
22	5. Trivy Scan - Container vulnerability scanning
23	6. ASH Scan - Automated Security Helper (aggregated SAST/IaC/secret scanners)
24	7. Deployment Verification - Validate deployment readiness
25	8. Summary Report - Generate findings summary
26	9. HTML Report - Create visual report
27
28	## Prerequisites
29
30	- AWS CDK project
31	- Viperlight CLI installed
32	- Trivy CLI installed
33	- ASH (Automated Security Helper) - installed via `uvx` from https://github.com/awslabs/automated-security-helper
34	- Docker (required for ASH container mode)
35
36	## Usage
37
38	```bash
39	# Run security scan
40	"Run security scan on my CDK project"
41	"Check this project for vulnerabilities"
42	"Generate security compliance report"
43	```
44
45	## Output
46
47	Results saved to `security-scan-results/{TIMESTAMP}/`:
48	- Raw scan outputs per tool
49	- `clean-results/` - Parsed findings
50	- `security-report.html` - Visual report
51
52	## Enforcement Rules
53
54	- Execute ALL scan commands (no skipping)
55	- Fix issues found (don't just comment them)
56	- Non-interactive execution only
57	- Continue pipeline on individual step failures
58
59	## References
60
61	- [Architecture Diagram](./references/architecture-diagram.md)
62	- [CDK Synthesis](./references/cdk-synthesis.md)
63	- [Viperlight Scan](./references/viperlight-scan.md)
64	- [License Check](./references/license-check.md)
65	- [Trivy Scan](./references/trivy-scan.md)
66	- [ASH Scan](./references/ash-scan.md)
67	- [Deployment Verification](./references/deployment-verification.md)
68	- [Report Generation](./references/report-generation.md)

People who liked this also viewed

6 picks

Type