Runs a fast AWS Security Agent diff scan on only changed code since a git ref. Useful for pre-commit, pre-PR, or any security check on uncommitted or branch changes.
How this skill is triggered — by the user, by Claude, or both
Slash command
/aws-agents-for-devsecops:diff-scanning-with-aws-security-agentThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.
Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.
Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.
Track scans in .security-agent/scans.json.
| Placeholder | How to resolve |
|---|---|
<id> (agent space) | config.agent_space_id |
<region> | config.region (default us-east-1) |
<account> | aws sts get-caller-identity --query Account --output text |
<role-arn> | arn:aws:iam::<account>:role/SecurityAgentScanRole |
<bucket> | security-agent-scans-<account>-<region> |
<WORKSPACE_ID> | printf '%s' "$(pwd)" | md5sum | cut -c1-12 |
Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
Ask what to scan against:
BASE_REF=HEAD (default)BASE_REF=mainGenerate diff (fail fast if empty):
cd <absolute-workspace-path>
if [ "$BASE_REF" = "HEAD" ]; then
git diff HEAD > /tmp/diff.patch
else
git diff "$BASE_REF..HEAD" > /tmp/diff.patch
fi
[ -s /tmp/diff.patch ] || { echo "No changes vs $BASE_REF"; exit 1; }
Zip the workspace (same exclusions as full scan, 2 GB limit):
cd <absolute-workspace-path>
zip -r /tmp/source.zip . \
-x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
-x "__pycache__/*" -x ".venv/*" -x "venv/*" \
-x "dist/*" -x "build/*" -x "target/*" \
-x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
-x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"
Upload both source zip and diff patch:
SCAN_ID="diff-$(date +%s)-$(openssl rand -hex 3)"
aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip
aws s3 cp /tmp/diff.patch s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch
Get or create per-workspace CodeReview (same logic as full scan — lookup config.json → code_reviews[<abs_path>], create if absent):
aws securityagent create-code-review --agent-space-id <id> --title <title> \
--service-role <role-arn> \
--assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]
Start the diff job:
aws securityagent start-code-review-job --agent-space-id <id> --code-review-id <cr-id> \
--diff-source s3Uri=s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch
If ResourceNotFoundException: recreate CodeReview and retry.
Capture codeReviewJobId. Persist to scans.json with scan_type: "DIFF" and base_ref.
Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."
Poll every 2 minutes:
aws securityagent batch-get-code-review-jobs --agent-space-id <id> --code-review-job-ids <job_id>
Only respond when status changes. On COMPLETED → fetch findings.
Findings: same presentation as full scan — grouped by severity, report written to .security-agent/findings-{scan_id}.md.
BASE_REF=HEAD if user doesn't specifydiff-<git-branch>-<timestamp> (no spaces)2plugins reuse this skill
First indexed Jun 18, 2026
npx claudepluginhub andrekurait/claude-marketplace-test --plugin aws-agents-for-devsecopsRuns a fast AWS Security Agent diff scan on only changed code since a git ref. Useful for pre-commit, pre-PR, or any security check on uncommitted or branch changes.
Audits staged git diffs for OWASP Top 10 issues and dependency typosquatting before committing. Designed for pre-commit review of security-sensitive changes.