diff-scanning-with-aws-security-agent

Name: diff-scanning-with-aws-security-agent
Author: aws

253installs190forks

How to install diff-scanning-with-aws-security-agent?

aws/agent-toolkit-for-aws/diff-scanning-with-aws-security-agent

$npx -y skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent

Installs into the current project.

Summary

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

Files · 1

View on GitHub

SKILL.md

1	# AWS Security Agent — Diff Scan
2
3	Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.
4
5	## Local state
6
7	Read `.security-agent/config.json` for `agent_space_id` and `region`. If missing, run the `setup-security-agent` workflow inline first.
8
9	Track scans in `.security-agent/scans.json`.
10
11	### Resolving the values you need
12
13	\| Placeholder \| How to resolve \|
14	\|-------------\|----------------\|
15	\| `<id>` (agent space) \| `config.agent_space_id` \|
16	\| `<region>` \| `config.region` (default `us-east-1`) \|
17	\| `<account>` \| `aws sts get-caller-identity --query Account --output text` \|
18	\| `<role-arn>` \| `arn:aws:iam::<account>:role/SecurityAgentScanRole` \|
19	\| `<bucket>` \| `security-agent-scans-<account>-<region>` \|
20	\| `<WORKSPACE_ID>` \| `printf '%s' "$(pwd)" \\| md5sum \\| cut -c1-12` \|
21
22	---
23
24	## Workflow
25
26	1. Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
27
28	2. Ask what to scan against:
29	- Uncommitted changes → `BASE_REF=HEAD` (default)
30	- Branch vs main → `BASE_REF=main`
31	- Custom ref → user provides
32
33	3. Generate diff (fail fast if empty):
34
35	```bash
36	cd <absolute-workspace-path>
37	if [ "$BASE_REF" = "HEAD" ]; then
38	git diff HEAD > /tmp/diff.patch
39	else
40	git diff "$BASE_REF..HEAD" > /tmp/diff.patch
41	fi
42	[ -s /tmp/diff.patch ] \|\| { echo "No changes vs $BASE_REF"; exit 1; }
43	```
44
45	4. Zip the workspace (same exclusions as full scan, 2 GB limit):
46
47	```bash
48	cd <absolute-workspace-path>
49	zip -r /tmp/source.zip . \
50	-x ".git/" -x ".security-agent/" -x "node_modules/*" \
51	-x "__pycache__/" -x ".venv/" -x "venv/*" \
52	-x "dist/" -x "build/" -x "target/*" \
53	-x ".mypy_cache/" -x ".pytest_cache/" -x ".tox/*" \
54	-x ".next/" -x "cdk.out/" -x ".DS_Store" -x "*.pyc"
55	```
56
57	5. Upload both source zip and diff patch:
58
59	```bash
60	SCAN_ID="diff-$(date +%s)-$(openssl rand -hex 3)"
61	aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
62	aws s3 cp /tmp/diff.patch s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch
63	```
64
65	6. Get or create per-workspace CodeReview (same logic as full scan — lookup `config.json → code_reviews[<abs_path>]`, create if absent):
66
67	```bash
68	aws securityagent create-code-review --agent-space-id <id> --title <title> \
69	--service-role <role-arn> \
70	--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]
71	```
72
73	7. Start the diff job:
74
75	```bash
76	aws securityagent start-code-review-job --agent-space-id <id> --code-review-id <cr-id> \
77	--diff-source s3Uri=s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch
78	```
79
80	If `ResourceNotFoundException`: recreate CodeReview and retry.
81
82	8. Capture `codeReviewJobId`. Persist to `scans.json` with `scan_type: "DIFF"` and `base_ref`.
83
84	9. Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."
85
86	10. Poll every 2 minutes:
87
88	```bash
89	aws securityagent batch-get-code-review-jobs --agent-space-id <id> --code-review-job-ids <job_id>
90	```
91
92	Only respond when status changes. On COMPLETED → fetch findings.
93
94	11. Findings: same presentation as full scan — grouped by severity, report written to `.security-agent/findings-{scan_id}.md`.
95
96	---
97
98	## Rules
99
100	- Diff scans are standalone — no prior full scan needed
101	- Poll every 2 minutes, not faster
102	- Default to `BASE_REF=HEAD` if user doesn't specify
103	- Title: `diff-<git-branch>-<timestamp>` (no spaces)
104	- If diff is empty, tell user and stop — don't start a scan

People who liked this also viewed

6 picks

Type

diff-scanning-with-aws-security-agent

253installs190forks

View on GitHub

How to install diff-scanning-with-aws-security-agent?

aws/agent-toolkit-for-aws/diff-scanning-with-aws-security-agent

$npx -y skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Security Agent — Diff Scan
2
3	Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.
4
5	## Local state
6
7	Read `.security-agent/config.json` for `agent_space_id` and `region`. If missing, run the `setup-security-agent` workflow inline first.
8
9	Track scans in `.security-agent/scans.json`.
10
11	### Resolving the values you need
12
13	\| Placeholder \| How to resolve \|
14	\|-------------\|----------------\|
15	\| `<id>` (agent space) \| `config.agent_space_id` \|
16	\| `<region>` \| `config.region` (default `us-east-1`) \|
17	\| `<account>` \| `aws sts get-caller-identity --query Account --output text` \|
18	\| `<role-arn>` \| `arn:aws:iam::<account>:role/SecurityAgentScanRole` \|
19	\| `<bucket>` \| `security-agent-scans-<account>-<region>` \|
20	\| `<WORKSPACE_ID>` \| `printf '%s' "$(pwd)" \\| md5sum \\| cut -c1-12` \|
21
22	---
23
24	## Workflow
25
26	1. Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
27
28	2. Ask what to scan against:
29	- Uncommitted changes → `BASE_REF=HEAD` (default)
30	- Branch vs main → `BASE_REF=main`
31	- Custom ref → user provides
32
33	3. Generate diff (fail fast if empty):
34
35	```bash
36	cd <absolute-workspace-path>
37	if [ "$BASE_REF" = "HEAD" ]; then
38	git diff HEAD > /tmp/diff.patch
39	else
40	git diff "$BASE_REF..HEAD" > /tmp/diff.patch
41	fi
42	[ -s /tmp/diff.patch ] \|\| { echo "No changes vs $BASE_REF"; exit 1; }
43	```
44
45	4. Zip the workspace (same exclusions as full scan, 2 GB limit):
46
47	```bash
48	cd <absolute-workspace-path>
49	zip -r /tmp/source.zip . \
50	-x ".git/" -x ".security-agent/" -x "node_modules/*" \
51	-x "__pycache__/" -x ".venv/" -x "venv/*" \
52	-x "dist/" -x "build/" -x "target/*" \
53	-x ".mypy_cache/" -x ".pytest_cache/" -x ".tox/*" \
54	-x ".next/" -x "cdk.out/" -x ".DS_Store" -x "*.pyc"
55	```
56
57	5. Upload both source zip and diff patch:
58
59	```bash
60	SCAN_ID="diff-$(date +%s)-$(openssl rand -hex 3)"
61	aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
62	aws s3 cp /tmp/diff.patch s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch
63	```
64
65	6. Get or create per-workspace CodeReview (same logic as full scan — lookup `config.json → code_reviews[<abs_path>]`, create if absent):
66
67	```bash
68	aws securityagent create-code-review --agent-space-id <id> --title <title> \
69	--service-role <role-arn> \
70	--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]
71	```
72
73	7. Start the diff job:
74
75	```bash
76	aws securityagent start-code-review-job --agent-space-id <id> --code-review-id <cr-id> \
77	--diff-source s3Uri=s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch
78	```
79
80	If `ResourceNotFoundException`: recreate CodeReview and retry.
81
82	8. Capture `codeReviewJobId`. Persist to `scans.json` with `scan_type: "DIFF"` and `base_ref`.
83
84	9. Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."
85
86	10. Poll every 2 minutes:
87
88	```bash
89	aws securityagent batch-get-code-review-jobs --agent-space-id <id> --code-review-job-ids <job_id>
90	```
91
92	Only respond when status changes. On COMPLETED → fetch findings.
93
94	11. Findings: same presentation as full scan — grouped by severity, report written to `.security-agent/findings-{scan_id}.md`.
95
96	---
97
98	## Rules
99
100	- Diff scans are standalone — no prior full scan needed
101	- Poll every 2 minutes, not faster
102	- Default to `BASE_REF=HEAD` if user doesn't specify
103	- Title: `diff-<git-branch>-<timestamp>` (no spaces)
104	- If diff is empty, tell user and stop — don't start a scan

People who liked this also viewed

6 picks

Type