Scanning With AWS Security Agent
Run an AWS Security Agent scan on the workspace, uploads the source to AWS, scans it...
Install
npx skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent -g -a claude-code -y- Repository
- aws/agent-toolkit-for-aws3.4k
- Category
- Security
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 2,662 tokens
- Runs scripts
- No, instructions only
What it does
Run an AWS Security Agent scan on the workspace, uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security scan or review, check security issues, check scan status, show findings, list recent scans, or stop a scan.
AWS Security Agent, Code Scans
This skill handles full repository scans. Setup (agent space, role, bucket) is handled by the setup-security-agent skill, if .security-agent/config.json is missing, the scan workflow auto-runs setup inline first.
Action mapping
| User intent | Workflow |
|---|---|
| Direct scan request ("scan my code", "find vulnerabilities") | Full Scan |
| Scan status check ("how's the scan", "progress") | Status workflow |
| View findings ("what did it find", "show results") | Findings workflow |
| List scans ("recent scans", "show my scans") | Read .security-agent/scans.json |
| Stop a scan | aws securityagent stop-code-review-job |
Rules for proactive suggestions
- Always ask before running, never auto-trigger scans
- Single-line suggestions, not multi-paragraph pitches
- If the user declines, do not bring it up again in the same session
Local state
Read .security-agent/config.json for agent_space_id and region. If config.json is missing, tell the user one line, "First scan in this workspace, running setup first.", and run the setup-security-agent workflow inline (steps from that skill's SKILL.md) before continuing. First-time scans should "just work."
Track scans in .security-agent/scans.json (keep last 50 entries). The per-workspace CodeReview ID is stored in config.json → code_reviews[<abs_path>] so subsequent scans reuse the same CodeReview.
Resolving the values you need
The CLI examples below use placeholders. Resolve them at the start of every scan:
