scanning-with-aws-security-agent

Name: scanning-with-aws-security-agent
Author: aws

252installs190forks

How to install scanning-with-aws-security-agent?

aws/agent-toolkit-for-aws/scanning-with-aws-security-agent

$npx -y skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent

Installs into the current project.

Summary

Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security sca

Files · 1

View on GitHub

SKILL.md

1	# AWS Security Agent — Code Scans
2
3	This skill handles full repository scans. Setup (agent space, role, bucket) is handled by the `setup-security-agent` skill — if `.security-agent/config.json` is missing, the scan workflow auto-runs setup inline first.
4
5	---
6
7	## Action mapping
8
9	\| User intent \| Workflow \|
10	\|-------------\|----------\|
11	\| Direct scan request ("scan my code", "find vulnerabilities") \| Full Scan \|
12	\| Scan status check ("how's the scan", "progress") \| Status workflow \|
13	\| View findings ("what did it find", "show results") \| Findings workflow \|
14	\| List scans ("recent scans", "show my scans") \| Read `.security-agent/scans.json` \|
15	\| Stop a scan \| `aws securityagent stop-code-review-job` \|
16
17	### Rules for proactive suggestions
18
19	- Always ask before running — never auto-trigger scans
20	- Single-line suggestions, not multi-paragraph pitches
21	- If the user declines, do not bring it up again in the same session
22
23	---
24
25	## Local state
26
27	Read `.security-agent/config.json` for `agent_space_id` and `region`. If `config.json` is missing, tell the user one line — "First scan in this workspace — running setup first." — and run the `setup-security-agent` workflow inline (steps from that skill's SKILL.md) before continuing. First-time scans should "just work."
28
29	Track scans in `.security-agent/scans.json` (keep last 50 entries). The per-workspace CodeReview ID is stored in `config.json → code_reviews[<abs_path>]` so subsequent scans reuse the same CodeReview.
30
31	### Resolving the values you need
32
33	The CLI examples below use placeholders. Resolve them at the start of every scan:
34
35	\| Placeholder \| How to resolve \|
36	\|-------------\|----------------\|
37	\| `<id>` (agent space) \| `config.agent_space_id` \|
38	\| `<region>` \| `config.region` (default `us-east-1`) \|
39	\| `<account>` \| `aws sts get-caller-identity --query Account --output text` (cache for the rest of the turn) \|
40	\| `<role-arn>` \| `arn:aws:iam::<account>:role/SecurityAgentScanRole` \|
41	\| `<bucket>` \| `security-agent-scans-<account>-<region>` \|
42	\| `<cr-id>` \| `code_review_id` from `config.json → code_reviews[<abs_path>]` \|
43	\| `<job_id>` \| `codeReviewJobId` returned by `start-code-review-job` \|
44	\| `<WORKSPACE_ID>` \| `printf '%s' "$(pwd)" \\| md5sum \\| cut -c1-12` \|
45
46	These are derived rather than stored in config so they can never drift out of sync with reality.
47
48	---
49
50	## Pre-scan checks
51
52	1. Read `config.json`. If missing → run the `setup-security-agent` workflow inline first, then continue.
53	2. Verify agent space still exists:
54
55	```bash
56	aws securityagent batch-get-agent-spaces --agent-space-ids <id>
57	```
58
59	If response shows it doesn't exist, clear `agent_space_id` from `config.json` and run `setup-security-agent` again.
60	3. Resolve account, role ARN, and bucket name from the table above.
61	4. Generate workspace ID:
62
63	```bash
64	WORKSPACE_ID=$(printf '%s' "$(pwd)" \| md5sum \| cut -c1-12)
65	```
66
67	---
68
69	## Workflow: Full Scan (~45 min)
70
71	For scanning only changed code, use the `diff-scanning-with-aws-security-agent` skill instead. For threat modeling specs, use `threat-modeling-with-aws-security-agent`.
72
73	1. Run pre-scan checks above.
74	2. Zip the workspace. Exclude common build/cache directories. Honor `.gitignore`. Bail if zip > 2 GB.
75
76	```bash
77	cd <absolute-workspace-path>
78	zip -r /tmp/source.zip . \
79	-x ".git/*" \
80	-x ".security-agent/*" \
81	-x "node_modules/*" \
82	-x "__pycache__/*" \
83	-x ".venv/" -x "venv/" \
84	-x "dist/" -x "build/" -x "target/*" \
85	-x ".mypy_cache/" -x ".pytest_cache/" -x ".tox/*" \
86	-x ".next/" -x "cdk.out/" \
87	-x ".DS_Store" -x "Thumbs.db" \
88	-x ".pyc" -x ".pyo"
89	ZIP_BYTES=$(stat -f%z /tmp/source.zip 2>/dev/null \|\| stat -c%s /tmp/source.zip)
90	if [ "$ZIP_BYTES" -gt 2147483648 ]; then echo "Zip too large (>2GB)"; exit 1; fi
91	```
92
93	3. Upload to the per-workspace stable key (overwrites any prior upload):
94
95	```bash
96	aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
97	```
98
99	4. Get or create the per-workspace CodeReview. Look up `config.json → code_reviews[<abs_path>]`.
100	- If present, use that `code_review_id`.
101	- If absent, create:
102
103	```bash
104	aws securityagent create-code-review --agent-space-id <id> --title <title> \
105	--service-role <role-arn> \
106	--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]
107	```
108
109	Capture `codeReviewId` and persist to `config.json → code_reviews[<abs_path>]`.
110	- Title default: `pre-cr-<git-branch>` (use `gi

People who liked this also viewed

6 picks

Type

scanning-with-aws-security-agent

252installs190forks

View on GitHub

How to install scanning-with-aws-security-agent?

aws/agent-toolkit-for-aws/scanning-with-aws-security-agent

$npx -y skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Security Agent — Code Scans
2
3	This skill handles full repository scans. Setup (agent space, role, bucket) is handled by the `setup-security-agent` skill — if `.security-agent/config.json` is missing, the scan workflow auto-runs setup inline first.
4
5	---
6
7	## Action mapping
8
9	\| User intent \| Workflow \|
10	\|-------------\|----------\|
11	\| Direct scan request ("scan my code", "find vulnerabilities") \| Full Scan \|
12	\| Scan status check ("how's the scan", "progress") \| Status workflow \|
13	\| View findings ("what did it find", "show results") \| Findings workflow \|
14	\| List scans ("recent scans", "show my scans") \| Read `.security-agent/scans.json` \|
15	\| Stop a scan \| `aws securityagent stop-code-review-job` \|
16
17	### Rules for proactive suggestions
18
19	- Always ask before running — never auto-trigger scans
20	- Single-line suggestions, not multi-paragraph pitches
21	- If the user declines, do not bring it up again in the same session
22
23	---
24
25	## Local state
26
27	Read `.security-agent/config.json` for `agent_space_id` and `region`. If `config.json` is missing, tell the user one line — "First scan in this workspace — running setup first." — and run the `setup-security-agent` workflow inline (steps from that skill's SKILL.md) before continuing. First-time scans should "just work."
28
29	Track scans in `.security-agent/scans.json` (keep last 50 entries). The per-workspace CodeReview ID is stored in `config.json → code_reviews[<abs_path>]` so subsequent scans reuse the same CodeReview.
30
31	### Resolving the values you need
32
33	The CLI examples below use placeholders. Resolve them at the start of every scan:
34
35	\| Placeholder \| How to resolve \|
36	\|-------------\|----------------\|
37	\| `<id>` (agent space) \| `config.agent_space_id` \|
38	\| `<region>` \| `config.region` (default `us-east-1`) \|
39	\| `<account>` \| `aws sts get-caller-identity --query Account --output text` (cache for the rest of the turn) \|
40	\| `<role-arn>` \| `arn:aws:iam::<account>:role/SecurityAgentScanRole` \|
41	\| `<bucket>` \| `security-agent-scans-<account>-<region>` \|
42	\| `<cr-id>` \| `code_review_id` from `config.json → code_reviews[<abs_path>]` \|
43	\| `<job_id>` \| `codeReviewJobId` returned by `start-code-review-job` \|
44	\| `<WORKSPACE_ID>` \| `printf '%s' "$(pwd)" \\| md5sum \\| cut -c1-12` \|
45
46	These are derived rather than stored in config so they can never drift out of sync with reality.
47
48	---
49
50	## Pre-scan checks
51
52	1. Read `config.json`. If missing → run the `setup-security-agent` workflow inline first, then continue.
53	2. Verify agent space still exists:
54
55	```bash
56	aws securityagent batch-get-agent-spaces --agent-space-ids <id>
57	```
58
59	If response shows it doesn't exist, clear `agent_space_id` from `config.json` and run `setup-security-agent` again.
60	3. Resolve account, role ARN, and bucket name from the table above.
61	4. Generate workspace ID:
62
63	```bash
64	WORKSPACE_ID=$(printf '%s' "$(pwd)" \| md5sum \| cut -c1-12)
65	```
66
67	---
68
69	## Workflow: Full Scan (~45 min)
70
71	For scanning only changed code, use the `diff-scanning-with-aws-security-agent` skill instead. For threat modeling specs, use `threat-modeling-with-aws-security-agent`.
72
73	1. Run pre-scan checks above.
74	2. Zip the workspace. Exclude common build/cache directories. Honor `.gitignore`. Bail if zip > 2 GB.
75
76	```bash
77	cd <absolute-workspace-path>
78	zip -r /tmp/source.zip . \
79	-x ".git/*" \
80	-x ".security-agent/*" \
81	-x "node_modules/*" \
82	-x "__pycache__/*" \
83	-x ".venv/" -x "venv/" \
84	-x "dist/" -x "build/" -x "target/*" \
85	-x ".mypy_cache/" -x ".pytest_cache/" -x ".tox/*" \
86	-x ".next/" -x "cdk.out/" \
87	-x ".DS_Store" -x "Thumbs.db" \
88	-x ".pyc" -x ".pyo"
89	ZIP_BYTES=$(stat -f%z /tmp/source.zip 2>/dev/null \|\| stat -c%s /tmp/source.zip)
90	if [ "$ZIP_BYTES" -gt 2147483648 ]; then echo "Zip too large (>2GB)"; exit 1; fi
91	```
92
93	3. Upload to the per-workspace stable key (overwrites any prior upload):
94
95	```bash
96	aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
97	```
98
99	4. Get or create the per-workspace CodeReview. Look up `config.json → code_reviews[<abs_path>]`.
100	- If present, use that `code_review_id`.
101	- If absent, create:
102
103	```bash
104	aws securityagent create-code-review --agent-space-id <id> --title <title> \
105	--service-role <role-arn> \
106	--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]
107	```
108
109	Capture `codeReviewId` and persist to `config.json → code_reviews[<abs_path>]`.
110	- Title default: `pre-cr-<git-branch>` (use `gi

People who liked this also viewed

6 picks

Type