security-scan

Q: How do I install security-scan?

Run npx skills add https://github.com/aws-samples/sample-agent-skills-for-builders --skill security-scan in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-scan/ (personal) or .claude/skills/security-scan/ (project).

by aws-samplesSecurity

Comprehensive security and compliance scanning for AWS CDK projects. Use when running security audits, checking license compliance, scanning container vulnerabilities, or running aggregated SAST/IaC/secret analysis before deployment.

Installs: 67
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/aws-samples/sample-agent-skills-for-builders --skill security-scan

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads security-scan automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Security Scan

Comprehensive AWS CDK project security and compliance scanning with multi-tool analysis.

When to Apply

Reference this skill when:

Running security audits on CDK projects
Checking license compliance
Scanning container images for vulnerabilities
Running aggregated SAST/IaC/secret analysis (via ASH)
Generating security reports for review

How It Works

IMPORTANT: All 9 steps are mandatory. Do not skip steps regardless of time constraints.

Architecture Diagram - Capture system architecture
CDK Synthesis - Generate CloudFormation templates
Viperlight Scan - Code security analysis
License Check - Dependency license compliance
Trivy Scan - Container vulnerability scanning
ASH Scan - Automated Security Helper (aggregated SAST/IaC/secret scanners)
Deployment Verification - Validate deployment readiness
Summary Report - Generate findings summary
HTML Report - Create visual report

Prerequisites

AWS CDK project
Viperlight CLI installed
Trivy CLI installed
ASH (Automated Security Helper) - installed via uvx from https://github.com/awslabs/automated-security-helper
Docker (required for ASH container mode)

Usage

# Run security scan
"Run security scan on my CDK project"
"Check this project for vulnerabilities"
"Generate security compliance report"

Output

Results saved to security-scan-results/{TIMESTAMP}/:

Raw scan outputs per tool
clean-results/ - Parsed findings
security-report.html - Visual report

Enforcement Rules

Execute ALL scan commands (no skipping)
Fix issues found (don't just comment them)
Non-interactive execution only
Continue pipeline on individual step failures

References

Architecture Diagram
CDK Synthesis
Viperlight Scan
License Check
Trivy Scan
ASH Scan
Deployment Verification
Report Generation

FAQ

What does the security-scan skill do?

How do I install security-scan?

Run npx skills add https://github.com/aws-samples/sample-agent-skills-for-builders --skill security-scan in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/security-scan/ (personal) or .claude/skills/security-scan/ (project).

Which AI agents can use security-scan?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is security-scan safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains security-scan?

It is published by aws-samples in aws-samples/sample-agent-skills-for-builders. It has 67 recorded installs.