Official agent skill

Diff Scanning With AWS Security Agent

Run a fast AWS Security Agent diff scan on only the changed code since a git ref.

OfficialApache-2.0Auto-check passedSecurity

Install Diff Scanning With AWS Security Agent

skills CLI

$ npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent .claude/skills/diff-scanning-with-aws-security-agent && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "diff-scanning-with-aws-security-agent" agent skill from https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent into .claude/skills/diff-scanning-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "diff-scanning-with-aws-security-agent", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent .agents/skills/diff-scanning-with-aws-security-agent && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "diff-scanning-with-aws-security-agent" agent skill from https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent into .agents/skills/diff-scanning-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "diff-scanning-with-aws-security-agent", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent .cursor/skills/diff-scanning-with-aws-security-agent && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "diff-scanning-with-aws-security-agent" agent skill from https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent into .cursor/skills/diff-scanning-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "diff-scanning-with-aws-security-agent", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/aws/agent-toolkit-for-aws.git --path plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent .gemini/skills/diff-scanning-with-aws-security-agent && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "diff-scanning-with-aws-security-agent" agent skill from https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent into .gemini/skills/diff-scanning-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "diff-scanning-with-aws-security-agent", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent .github/skills/diff-scanning-with-aws-security-agent && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "diff-scanning-with-aws-security-agent" agent skill from https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent into .github/skills/diff-scanning-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "diff-scanning-with-aws-security-agent", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install aws/agent-toolkit-for-aws diff-scanning-with-aws-security-agent --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent .opencode/skills/diff-scanning-with-aws-security-agent && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "diff-scanning-with-aws-security-agent" agent skill from https://github.com/aws/agent-toolkit-for-aws/tree/main/plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent into .opencode/skills/diff-scanning-with-aws-security-agent/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "diff-scanning-with-aws-security-agent", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: diff-scanning-with-aws-security-agent
GitHub stars: 2.8k
Token cost: ~1k tokens
SKILL.md length: 284 words
Files: 1
Skills in repo: 138
Repo updated: Oct 7, 2026
First seen: Oct 7, 2026
Licence: Apache-2.0

At a glance

Run a fast AWS Security Agent diff scan on only the changed code since a git ref.

Works in 11 steps: Pre-scan checks. Same as full scan —… → Ask what to scan against → Generate diff (fail fast if empty) → …
The user asks to scan changes
SKILL.md covers Local state, Workflow and Rules
Calls aws, git and openssl

What it does

Diff Scanning With AWS Security Agent is an agent skill from aws/agent-toolkit-for-aws, published by the product's own GitHub organization. Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Cloud security. It works with Git and Amazon Web Services. The repository describes itself as: Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS. The licence is Apache-2.0.

When your agent uses it

The user asks to scan changes
Run a diff scan
Check what changed for security issues
Scan before committing

Example prompts

“/diff-scanning-with-aws-security-agent”

Workflow steps

11 steps, taken from the first numbered list in SKILL.md.

Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
Ask what to scan against
Generate diff (fail fast if empty)
Zip the workspace (same exclusions as full scan, 2 GB limit)
Upload both source zip and diff patch
Get or create per-workspace CodeReview (same logic as full scan — lookup config.json → code_reviews[], create if absent)
Start the diff job
Capture codeReviewJobId. Persist to scans.json with scan_type: "DIFF" and base_ref.
Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."
Poll every 2 minutes
Findings: same presentation as full scan — grouped by severity, report written to .security-agent/findings-{scan_id}.md.

What it can do on your machine

Read from SKILL.md and the folder at commit bd49cc8. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
- aws
- git
- openssl
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use aws and git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Diff Scanning With AWS Security Agent loads about 1k tokens when it runs. Until then it costs about 75 tokens; SKILL.md has 284 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~75
When it runs · the whole SKILL.md, loaded when a task matches: ~1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aws/agent-toolkit-for-aws at commit bd49cc8, republished under its Apache-2.0 licence (© aws). 284 words, ~1,019 tokens.

Download SKILL.mdSave it as .claude/skills/diff-scanning-with-aws-security-agent/SKILL.md (or your agent's skills folder).

name: diff-scanning-with-aws-security-agent
description: Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Use when the user asks to scan changes, run a diff scan, check what changed for security issues, scan before committing, scan before PR, or any pre-commit/pre-push security check.

AWS Security Agent — Diff Scan

Scan only the code that changed since a git ref. Faster than a full scan — focuses findings on the diff. No prior full scan needed.

Local state

Read .security-agent/config.json for agent_space_id and region. If missing, run the setup-security-agent workflow inline first.

Track scans in .security-agent/scans.json.

Resolving the values you need

Placeholder	How to resolve
`<id>` (agent space)	`config.agent_space_id`
`<region>`	`config.region` (default `us-east-1`)
`<account>`	`aws sts get-caller-identity --query Account --output text`
`<role-arn>`	`arn:aws:iam::<account>:role/SecurityAgentScanRole`
`<bucket>`	`security-agent-scans-<account>-<region>`
`<WORKSPACE_ID>`	`printf '%s' "$(pwd)" \| md5sum \| cut -c1-12`

Workflow

Pre-scan checks. Same as full scan — read config, verify agent space, resolve values, generate workspace ID.
Ask what to scan against:
- Uncommitted changes → BASE_REF=HEAD (default)
- Branch vs main → BASE_REF=main
- Custom ref → user provides

Generate diff (fail fast if empty):

bash

cd <absolute-workspace-path>
if [ "$BASE_REF" = "HEAD" ]; then
  git diff HEAD > /tmp/diff.patch
else
  git diff "$BASE_REF..HEAD" > /tmp/diff.patch
fi
[ -s /tmp/diff.patch ] || { echo "No changes vs $BASE_REF"; exit 1; }

Zip the workspace (same exclusions as full scan, 2 GB limit):

bash

cd <absolute-workspace-path>
zip -r /tmp/source.zip . \
  -x ".git/*" -x ".security-agent/*" -x "node_modules/*" \
  -x "__pycache__/*" -x ".venv/*" -x "venv/*" \
  -x "dist/*" -x "build/*" -x "target/*" \
  -x ".mypy_cache/*" -x ".pytest_cache/*" -x ".tox/*" \
  -x ".next/*" -x "cdk.out/*" -x ".DS_Store" -x "*.pyc"

Upload both source zip and diff patch:

bash

SCAN_ID="diff-$(date +%s)-$(openssl rand -hex 3)"
aws s3 cp /tmp/source.zip s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip --expected-bucket-owner <account>
aws s3 cp /tmp/diff.patch s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch --expected-bucket-owner <account>

Get or create per-workspace CodeReview (same logic as full scan — lookup config.json → code_reviews[<abs_path>], create if absent):

bash

aws securityagent create-code-review --agent-space-id <id> --title <title> \
  --service-role <role-arn> \
  --assets sourceCode=[{s3Location=s3://<bucket>/security-scans/source/<WORKSPACE_ID>/source.zip}]

Start the diff job:

bash

aws securityagent start-code-review-job --agent-space-id <id> --code-review-id <cr-id> \
  --diff-source s3Uri=s3://<bucket>/security-scans/diffs/${SCAN_ID}/diff.patch

If ResourceNotFoundException: recreate CodeReview and retry.

Capture codeReviewJobId. Persist to scans.json with scan_type: "DIFF" and base_ref.
Tell user: "Diff scan started. Takes a few minutes. I'll check every 2 minutes — say 'stop polling' to opt out."

Poll every 2 minutes:

bash

aws securityagent batch-get-code-review-jobs --agent-space-id <id> --code-review-job-ids <job_id>

Only respond when status changes. On COMPLETED → fetch findings.

Findings: same presentation as full scan — grouped by severity, report written to .security-agent/findings-{scan_id}.md.

Show full SKILL.md (39 more words)Show less

Rules

Diff scans are standalone — no prior full scan needed
Poll every 2 minutes, not faster
Default to BASE_REF=HEAD if user doesn't specify
Title: diff-<git-branch>-<timestamp> (no spaces)
If diff is empty, tell user and stop — don't start a scan

Files

Just SKILL.md in plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent of aws/agent-toolkit-for-aws.

Open the folder on GitHubat commit bd49cc8

Compare with similar skills

Diff Scanning With AWS Security Agent next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Diff Scanning With AWS Security Agent compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Diff Scanning With AWS Security Agent this skillaws/agent-toolkit-for-aws	2.8k	—	~1k	Automated safety check: Pass	Apache-2.0	today
Cloud Auditbriiirussell/cybersecurity-skills	412	—	~1.3k	Automated safety check: Notes	MIT	4 mo ago
Security Setupluongnv89/skills	131	—	~4.5k	Automated safety check: Pass	MIT	today
Iamitsmostafa/aws-agent-skills	1.2k	—	~1.8k	Automated safety check: Pass	MIT	2 days ago
AWS Security ArchitectureHack23/cia	239	—	~2.3k	Automated safety check: Pass	Apache-2.0	yesterday
AWS Iamsickn33/agentic-awesome-skills	47k	2 repos	~3.4k	Automated safety check: Pass	MIT	yesterday

Similar skills

Cloud Audit
briiirussell/cybersecurity-skills
Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps.
412 GitHub stars~1.3k tokensUpdated 4 mo ago
SecurityAuto-check: notes
Security Setup
luongnv89/skills
Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.
131 GitHub stars~4.5k tokensUpdated today
SecurityAuto-check passed
Iam
itsmostafa/aws-agent-skills
AWS Identity and Access Management for users, roles, policies, and permissions.
1.2k GitHub stars~1.8k tokensUpdated 2 days ago
SecurityAuto-check passed
AWS Security Architecture
Hack23/cia
AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment
239 GitHub stars~2.3k tokensUpdated yesterday
SecurityAuto-check passed
AWS Iam
sickn33/agentic-awesome-skills
Manage IAM users, roles, and policies. An agent skill from sickn33/agentic-awesome-skills.
47k GitHub starsUsed in 2 repos~3.4k tokens
SecurityAuto-check passed
Implementing Cloud Vulnerability Posture Management
mukul975/Anthropic-Cybersecurity-Skills
Implement multi-cloud CSPM to detect cloud-native misconfigurations and vulnerabilities (IAM over-permissions, exposed storage, unencrypted data, missing network controls) using AWS Security Hub…
34k GitHub stars~1.9k tokensUpdated 1 mo ago
SecurityAuto-check passed

More from aws/agent-toolkit-for-aws

All 138 skills in this repo

Agent Advisor
aws/agent-toolkit-for-aws
Official
Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow.
2.8k GitHub stars~4.9k tokensUpdated today
Auto-check passed
Agents Build
aws/agent-toolkit-for-aws
Official
A skill your agent uses to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal.
2.8k GitHub stars~2.3k tokensUpdated today
Auto-check: notes
Launch With AWS
aws/agent-toolkit-for-aws
Official
Migrates vibe-coded web applications to AWS. An agent skill from aws/agent-toolkit-for-aws.
2.8k GitHub stars~3.2k tokensUpdated today
Auto-check passed
Processing S3 Uploads With Step Functions
aws/agent-toolkit-for-aws
Official
Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size.
2.8k GitHub stars~4k tokensUpdated today
Auto-check passed
AWS Marketplace Metering
aws/agent-toolkit-for-aws
Official
Deploys, queries, and debugs AWS Marketplace usage-based (PAYG) metering — the pipeline (ResolveCustomer, BatchMeterUsage, EventBridge via SAM) and querying/debugging metering records, statuses…
2.8k GitHub stars~18k tokensUpdated today
Auto-check passed
Agents Pay
aws/agent-toolkit-for-aws
Official
A skill your agent uses when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits.
2.8k GitHub stars~6.5k tokensUpdated today
Auto-check: notes

Works with

Questions about Diff Scanning With AWS Security Agent

What does Diff Scanning With AWS Security Agent do?

Run a fast AWS Security Agent diff scan on only the changed code since a git ref. Diff Scanning With AWS Security Agent is an agent skill from aws/agent-toolkit-for-aws, published by the product's own GitHub organization. Run a fast AWS Security Agent diff scan on only the changed code since a git ref.

When should I use Diff Scanning With AWS Security Agent?

Diff Scanning With AWS Security Agent fits situations like: the user asks to scan changes; run a diff scan; check what changed for security issues; scan before committing.

How do I install Diff Scanning With AWS Security Agent in Claude Code?

Run `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a claude-code`. Or copy the skill folder (plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent in aws/agent-toolkit-for-aws) into .claude/skills/diff-scanning-with-aws-security-agent in your project. Claude Code loads it when a task matches its description.

How do I install Diff Scanning With AWS Security Agent in Codex?

Run `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a codex`. Or copy the skill folder (plugins/aws-agents-for-devsecops/skills/diff-scanning-with-aws-security-agent in aws/agent-toolkit-for-aws) into .agents/skills/diff-scanning-with-aws-security-agent in your project. Codex loads it when a task matches its description.

Can I use Diff Scanning With AWS Security Agent in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aws/agent-toolkit-for-aws --skill diff-scanning-with-aws-security-agent -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/diff-scanning-with-aws-security-agent, .gemini/skills/diff-scanning-with-aws-security-agent, .github/skills/diff-scanning-with-aws-security-agent and .opencode/skills/diff-scanning-with-aws-security-agent in your project.

What does Diff Scanning With AWS Security Agent need to run?

Going by SKILL.md and its folder, Diff Scanning With AWS Security Agent needs the command-line tools its instructions call (aws, git and openssl).

Does Diff Scanning With AWS Security Agent access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Diff Scanning With AWS Security Agent safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Diff Scanning With AWS Security Agent use?

Diff Scanning With AWS Security Agent is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Diff Scanning With AWS Security Agent use?

About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Diff Scanning With AWS Security Agent?

Skills that share tags, products or a category with Diff Scanning With AWS Security Agent: Cloud Audit (briiirussell/cybersecurity-skills, 412 stars), Security Setup (luongnv89/skills, 131 stars), Iam (itsmostafa/aws-agent-skills, 1.2k stars) and AWS Security Architecture (Hack23/cia, 239 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Diff Scanning With AWS Security Agent?

aws (a GitHub organization, an official publisher) maintains it in aws/agent-toolkit-for-aws, which has 2,816 GitHub stars. The repository holds 138 skills in this directory. The repository was last updated on October 7, 2026.

Source: aws/agent-toolkit-for-aws on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Diff Scanning With AWS Security Agent

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

AWS Security Agent — Diff Scan

Local state

Resolving the values you need

Workflow

Rules

Files

Compare with similar skills

Similar skills

More from aws/agent-toolkit-for-aws

Related

Questions about Diff Scanning With AWS Security Agent