mcpField
S
security-scan

security-scan

github.com/aws-samplesSecurity5367 installsUpdated 9w ago
Repository

About security-scan

A security-scanning skill for AWS CDK projects, intended for teams auditing security, licenses, and deployment readiness. It requires a nine-step workflow combining code, container, and aggregated security analysis, with raw findings and HTML reports as output.

Key features

  1. 01Nine-step security scan workflow
  2. 02CloudFormation synthesis
  3. 03Viperlight code analysis
  4. 04License compliance checks
  5. 05Trivy and ASH scans
  6. 06HTML report generation

Use cases

  1. 01Audit an AWS CDK project
  2. 02Check dependency license compliance
  3. 03Scan container images for vulnerabilities
  4. 04Prepare security findings for review

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/aws-samples/sample-agent-skills-for-builders --skill security-scan

After installing, type/security-scanin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

README.md
references/
architecture-diagram.md
ash-scan.md
cdk-synthesis.md
deployment-verification.md
license-check.md
report-generation.md
trivy-scan.md
viperlight-scan.md
scripts/
generate-html-report.py
generate-license-report.py

Details

From the project README

Security Scan

Comprehensive AWS CDK project security and compliance scanning with multi-tool analysis.

When to Apply

Reference this skill when:

  • Running security audits on CDK projects
  • Checking license compliance
  • Scanning container images for vulnerabilities
  • Running aggregated SAST/IaC/secret analysis (via ASH)
  • Generating security reports for review

How It Works

IMPORTANT: All 9 steps are mandatory. Do not skip steps regardless of time constraints.

  1. Architecture Diagram - Capture system architecture
  2. CDK Synthesis - Generate CloudFormation templates
  3. Viperlight Scan - Code security analysis
  4. License Check - Dependency license compliance
  5. Trivy Scan - Container vulnerability scanning
  6. ASH Scan - Automated Security Helper (aggregated SAST/IaC/secret scanners)
  7. Deployment Verification - Validate deployment readiness
  8. Summary Report - Generate findings summary
  9. HTML Report - Create visual report

Prerequisites

Usage

# Run security scan
"Run security scan on my CDK project"
"Check this project for vulnerabilities"
"Generate security compliance report"

Output

Results saved to security-scan-results/{TIMESTAMP}/:

  • Raw scan outputs per tool
  • clean-results/ - Parsed findings
  • security-report.html - Visual report

Enforcement Rules

  • Execute ALL scan commands (no skipping)
  • Fix issues found (don't just comment them)
  • Non-interactive execution only
  • Continue pipeline on individual step failures

References

Comments

Markdown supported