scanning-with-aws-security-agent

Run an AWS Security Agent scan on the workspace — uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations. Use when the user asks to scan code, find vulnerabilities, run a security scan or review, check security issues, check scan status, show findings, list recent scans, or stop a scan.

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, executable skill body with clear workflows, validation checkpoints, and error-recovery feedback loops. Minor conciseness loss from cross-section restatement and a monolithic structure that could split reference detail into bundle files.

Suggestions

De-duplicate the polling-cadence and ResourceNotFoundException guidance so it lives in one place (the Rules or Troubleshooting section) rather than three.

Move the detailed findings-report markdown template and the placeholder-resolution table into a references/ file to shorten the main SKILL.md.

Dimension	Reasoning	Score
Conciseness	Mostly lean and actionable with no padding explaining concepts Claude already knows, though a few rules (polling cadence, ResourceNotFoundException handling) are restated across the workflow, rules, and troubleshooting sections.	4 / 5
Actionability	Fully executable bash commands with a placeholder-resolution table, concrete scans.json schema, and a copy-paste findings report template cover every common case (scan, status, findings, stop, list).	5 / 5
Workflow Clarity	Multi-step workflows are explicitly sequenced with validation checkpoints (config existence, agent-space verification), feedback loops (recreate CodeReview and retry on ResourceNotFoundException), and terminal-state handling in the polling loop.	5 / 5
Progressive Disclosure	Well-organized into clearly headed sections with an action-mapping overview up top and no nested references, though everything lives inline in a single ~310-line file with no bundle files to split detail into.	4 / 5
	Total	18 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-structured description that clearly states capabilities and provides comprehensive trigger phrases. The only weakness is minor overlap risk with sibling security-scan skills sharing generic scan/find-vulnerability triggers.

Suggestions

Narrow the opening triggers (e.g., 'full repository scan') to distinguish from the diff-scanning skill and reduce conflict risk.

Consider dropping 'check security issues' which is broad enough to fire for unrelated security questions.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'uploads the source to AWS, scans it with the managed Security Agent service, and returns ranked, verified findings with code locations and remediations' — giving comprehensive coverage of what the skill does.	5 / 5
Completeness	Explicitly answers both 'what' (upload, scan, return findings) and 'when' with a clearly labeled 'Use when...' clause containing concrete trigger phrases.	5 / 5
Trigger Term Quality	Extensive natural trigger phrases — 'scan code, find vulnerabilities, run a security scan or review, check security issues, check scan status, show findings, list recent scans, or stop a scan' — cover synonyms and varied phrasings a user would actually say.	5 / 5
Distinctiveness Conflict Risk	Clear AWS Security Agent niche with distinct triggers, but generic phrases like 'scan code' and 'find vulnerabilities' could overlap with the related diff-scanning skill referenced in the body, creating minor conflict risk.	4 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-agents-for-devsecops/skills/scanning-with-aws-security-agent/SKILL.md
Commit: 8ea26bd

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.