# Scanning With AWS Security Agent

Run an AWS Security Agent scan on the workspace, uploads the source to AWS, scans it...

- Repository: https://github.com/aws/agent-toolkit-for-aws (3366 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent -g -a claude-code -y`
Codex: `npx skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent -g -a codex -y`
Cursor: `npx skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent -g -a cursor -y`
Gemini CLI: `npx skills add aws/agent-toolkit-for-aws --skill scanning-with-aws-security-agent -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add aws/agent-toolkit-for-aws`

## Description

Run an AWS Security Agent scan on the workspace, uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security scan or review, check security issues, check scan status, show findings, list recent scans, or stop a scan.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# AWS Security Agent, Code Scans

This skill handles full repository scans. Setup (agent space, role, bucket) is handled by the **`setup-security-agent`** skill, if `.security-agent/config.json` is missing, the scan workflow auto-runs setup inline first.

---

## Action mapping

| User intent | Workflow |
|-------------|----------|
| Direct scan request ("scan my code", "find vulnerabilities") | Full Scan |
| Scan status check ("how's the scan", "progress") | Status workflow |
| View findings ("what did it find", "show results") | Findings workflow |
| List scans ("recent scans", "show my scans") | Read `.security-agent/scans.json` |
| Stop a scan | `aws securityagent stop-code-review-job` |

### Rules for proactive suggestions

- Always ask before running, never auto-trigger scans
- Single-line suggestions, not multi-paragraph pitches
- If the user declines, do not bring it up again in the same session

---

## Local state

Read `.security-agent/config.json` for `agent_space_id` and `region`. If `config.json` is missing, tell the user one line, "First scan in this workspace, running setup first.", and run the **`setup-security-agent`** workflow inline (steps from that skill's SKILL.md) before continuing. First-time scans should "just work."

Track scans in `.security-agent/scans.json` (keep last 50 entries). The per-workspace CodeReview ID is stored in `config.json → code_reviews[<abs_path>]` so subsequent scans reuse the same CodeReview.

### Resolving the values you need

The CLI examples below use placeholders. Resolve them at the start of every scan:

The rest: https://github.com/aws/agent-toolkit-for-aws/blob/HEAD/plugins/aws-agents-for-devsecops/skills/scanning-with-aws-security-agent/SKILL.md