diff-scanning-with-aws-security-agent
Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.
By aws · 1,147 installs
npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent
Source repository · Upstream listing
AWS Security Agent — Diff Scan
Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.
Local state
Read .security agent/config.json for agent space id and region . If missing, run the setup security agent workflow inline first.
Track scans in .security agent/scans.json .
Resolving the values you need
Placeholder How to resolve
<id (agent space) config.agent space id
<region config.region (default us east 1 )
<account aws sts get caller identity query Account output text
<role arn arn:aws:iam::<account :role/SecurityAgentScanRole
<bucket security agent scans <account <region
<WORKSPACE ID printf '%s' "$(pwd)" \ md5sum \ cut c1 12
Workflow
1. Pre scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
2. Ask what to scan against:
Uncommitted changes → BASE REF=HEAD (default)
Branch vs main → BASE REF=main
Custom ref → user provides
3. Generate diff (fail fast if empty):
4. Zip the workspace (same exclusions as full scan, 2 GB limit):
5. Upload both source zip and diff patch:
6. Get or create per workspace CodeReview (same logic as full scan — lookup config.json → code reviews[<abs path ] , create if absent):
7. Start the diff job:
If ResourceNotFoundException : recreate CodeReview and retry.
8. Capture codeReviewJobId . Persist to scans.json with scan type: "DIFF" and base ref .
9. Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."
10. Poll every 2 minutes:
Only respond when status changes. On COMPLETED → fetch findings.
11. Findings: same presentation as full scan — grouped by severity, report written to .security agent/findings {scan id}.md .
Rules
Diff scans are standalone — no prior full scan needed
Poll every 2 minutes, not faster
Default to BASE REF=HEAD if user doesn't specify
Title: diff <git branch <timestamp (no spaces)
If diff is empty, tell user and stop — don't start a scan