diff-scanning-with-aws-security-agent

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable, well-validated workflow with executable commands and error-recovery loops; the sole weakness is reliance on an external sibling 'full scan' skill for shared logic rather than self-contained or clearly navigable references.

Dimension	Reasoning	Score
Conciseness	Lean, command-dense procedure that assumes Claude's competence — it never explains what AWS or git diff is, and every section (resolution table, workflow, rules) earns its place despite minor repetition of 'No prior full scan needed'.	3 / 3
Actionability	Provides fully executable bash and AWS CLI commands (git diff, zip with exclusion flags, aws s3 cp, aws securityagent create/start/batch-get) with a resolution table mapping every placeholder to a concrete source, making them effectively copy-paste ready.	3 / 3
Workflow Clarity	A clearly sequenced 11-step workflow with explicit validation checkpoints — an empty-diff fail-fast guard, a ResourceNotFoundException recreate-and-retry feedback loop, and status-change polling — satisfying the score-3 anchor for error recovery.	3 / 3
Progressive Disclosure	No bundle files exist and the body is well-sectioned, but it repeatedly defers to a sibling skill ('same as full scan', 'run the setup-security-agent workflow inline first') without signaling navigable detail files, so referenced content is not clearly resolved.	2 / 3
	Total	11 / 12 Passed

Description

90%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A concise, well-targeted description with excellent trigger coverage and explicit when-guidance; its only gap is naming a single action rather than enumerating multiple concrete capabilities.

Dimension	Reasoning	Score
Specificity	Names the domain and one concrete action ('Run a fast AWS Security Agent diff scan on only the changed code since a git ref'), but lists a single action rather than the multiple specific concrete actions required by the score-3 anchor.	2 / 3
Completeness	Explicitly answers both 'what' (run a diff scan on changed code since a git ref) and 'when' via an explicit 'Use when...' clause with multiple concrete triggers.	3 / 3
Trigger Term Quality	Rich natural-language triggers ('scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, pre-commit/pre-push security check') give good coverage of terms a user would actually say.	3 / 3
Distinctiveness Conflict Risk	A clear niche (AWS Security Agent diff scan) with distinct pre-commit/pre-push security triggers makes it unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.