# Diff Scanning With AWS Security Agent

Run a fast AWS Security Agent diff scan on only the changed code since a git ref.

- Repository: https://github.com/aws/agent-toolkit-for-aws (3366 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -g -a claude-code -y`
Codex: `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -g -a codex -y`
Cursor: `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -g -a cursor -y`
Gemini CLI: `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add aws/agent-toolkit-for-aws`

## Description

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Security Agent, Diff Scan

Scan only the code that changed since a git ref. Faster than a full scan, focuses findings on the diff. No prior full scan needed.

## Local state

Read `.security-agent/config.json` for `agent_space_id` and `region`. If missing, run the `setup-security-agent` workflow inline first.

Track scans in `.security-agent/scans.json`.

### Resolving the values you need

| Placeholder | How to resolve |
|-------------|----------------|
| `<id>` (agent space) | `config.agent_space_id` |
| `<region>` | `config.region` (default `us-east-1`) |
| `<account>` | `aws sts get-caller-identity --query Account --output text` |
| `<role-arn>` | `arn:aws:iam::<account>:role/SecurityAgentScanRole` |
| `<bucket>` | `security-agent-scans-<account>-<region>` |
| `<WORKSPACE_ID>` | `printf '%s' "$(pwd)" \| md5sum \| cut -c1-12` |

---

## Workflow

1. **Pre-scan checks.** Same as full scan, read config, verify agent space, resolve values, generate workspace ID.

2. **Ask what to scan against:**
   - Uncommitted changes → `BASE_REF=HEAD` (default)
   - Branch vs main → `BASE_REF=main`
   - Custom ref → user provides

3. **Generate diff (fail fast if empty):**

   ```bash
   cd <absolute-workspace-path>
   if [ "$BASE_REF" = "HEAD" ]; then
     git diff HEAD > /tmp/diff.patch
   else
     git diff "$BASE_REF..HEAD" > /tmp/diff.patch
   fi
   [ -s /tmp/diff.patch ] || { echo "No changes vs $BASE_REF"; exit 1; }
   ```

4. **Zip the workspace** (same exclusions as full scan, 2 GB limit):

   ```bash
   cd <absolute-workspace-path>
   zip -r /tmp/source.zip . \
     -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
     -x "__pycache__/*" -x ".venv/*" -x "venv/*" \
     -x "dist/*" -x "build/*" -x "target/*" \
     -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
     -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"
   ```

5. **Upload both source zip and diff patch:**

The rest: https://github.com/aws/agent-toolkit-for-aws/blob/HEAD/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent/SKILL.md