diff-scanning-with-aws-security-agent

Original：🇺🇸 English

Translated

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

1installs

Sourceaws/agent-toolkit-for-aws

Added on2026-07-05

NPX Install

npx skill4agent add aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent

SKILL.md Content

View Translation Comparison →

AWS Security Agent — Diff Scan

Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.

Local state

Read

.security-agent/config.json

for

agent_space_id

and

region

. If missing, run the

setup-security-agent

workflow inline first.

Track scans in

.security-agent/scans.json

.

Resolving the values you need

Placeholder	How to resolve
`<id>` (agent space)	`config.agent_space_id`
`<region>`	`config.region` (default `us-east-1` )
`<account>`	`aws sts get-caller-identity --query Account --output text`
`<role-arn>`	`arn:aws:iam::<account>:role/SecurityAgentScanRole`
`<bucket>`	`security-agent-scans-<account>-<region>`
`<WORKSPACE_ID>`	`printf '%s' "$(pwd)" \| md5sum \| cut -c1-12`

Workflow

Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
Ask what to scan against:
- Uncommitted changes →
```
BASE_REF=HEAD
```
  (default)
- Branch vs main →
```
BASE_REF=main
```
- Custom ref → user provides

Generate diff (fail fast if empty):

bash

cd <absolute-workspace-path>
if [ "$BASE_REF" = "HEAD" ]; then
  git diff HEAD > /tmp/diff.patch
else
  git diff "$BASE_REF..HEAD" > /tmp/diff.patch
fi
[ -s /tmp/diff.patch ] || { echo "No changes vs $BASE_REF"; exit 1; }

Zip the workspace (same exclusions as full scan, 2 GB limit):

bash

cd <absolute-workspace-path>
zip -r /tmp/source.zip . \
  -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
  -x "__pycache__/*" -x ".venv/*" -x "venv/*" \
  -x "dist/*" -x "build/*" -x "target/*" \
  -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
  -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"

Upload both source zip and diff patch:

bash

SCAN_ID="diff-$(date +%s)-$(openssl rand -hex 3)"
aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
aws s3 cp /tmp/diff.patch s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch

Get or create per-workspace CodeReview (same logic as full scan — lookup

config.json → code_reviews[<abs_path>]

, create if absent):

bash

aws securityagent create-code-review --agent-space-id <id> --title <title> \
  --service-role <role-arn> \
  --assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]

Start the diff job:

bash

aws securityagent start-code-review-job --agent-space-id <id> --code-review-id <cr-id> \
  --diff-source s3Uri=s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch

If

ResourceNotFoundException

: recreate CodeReview and retry.

Capture

codeReviewJobId

. Persist to

scans.json

with

scan_type: "DIFF"

and

base_ref

.

Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."

Poll every 2 minutes:

bash

aws securityagent batch-get-code-review-jobs --agent-space-id <id> --code-review-job-ids <job_id>

Only respond when status changes. On COMPLETED → fetch findings.

Findings: same presentation as full scan — grouped by severity, report written to
```
.security-agent/findings-{scan_id}.md
```
.

Rules

Diff scans are standalone — no prior full scan needed
Poll every 2 minutes, not faster
Default to
```
BASE_REF=HEAD
```
if user doesn't specify
Title:
```
diff-<git-branch>-<timestamp>
```
(no spaces)
If diff is empty, tell user and stop — don't start a scan

diff-scanning-with-aws-security-agent

NPX Install

Tags

SKILL.md Content

AWS Security Agent — Diff Scan

Local state

Resolving the values you need

Workflow

Rules