scan

Files (1)

• SKILL.md

SKILL.md (first lines)

# /scan

Run a compliance scan using Prowler against your AWS account.

## Instructions

Use the Agent tool to spawn the scanner agent:
- `subagent_type`: `scanner`
- Pass `$ARGUMENTS` to the agent prompt so it knows what flags to use

Example agent prompt:
```
Run a Prowler compliance scan with these arguments: $ARGUMENTS

If no arguments provided, run a smart scan: discover active services and regions first, then scan only those, filtering noise.
If --full is passed, run a full SOC2 + HIPAA scan across all regions.
```

## Default Behavior (Smart Scan)

When no flags are provided, the scanner will:
1. **Discover active services** — run AWS discovery commands to find which services have user-created resources
2. **Discover active regions** — check where resources actually exist
3. **Scan only what matters** — use `--service` and `--region` with only the discovered values
4. **Filter noise** — remove findings for inactive services, multi-region duplicates in empty regions, and CIS-only CloudWatch checks

This typically reduces findings from 200-300 to 50-80 real compliance gaps.

## Usage Examples

```
/scan                          # Smart scan: auto-detect services + regions, filter noise
/scan --full                   # Full scan: all regions, all services, no filtering
/scan s3                       # Scan S3 service only
/scan --service s3,iam         # Scan S3 and IAM
/scan --check iam_root_mfa_enabled  # Single check
/scan --severity critical,high # Only critical and high
/scan --profile production     # Use specific AWS profile
/scan --region us-east-1       # Limit to one region (overrides auto-detection)
```

## Flags

| Flag | Description |
|---|---|
| `--full` | Skip service/region auto-detection, scan everything (all regions, all services) |
| `--service s3,iam` | Override service auto-detection, scan only these services |
| `--region us-east-1` | Override region auto-detection, scan only this region |
| `--check check_id` | Run specific Prowler check(s) |
| `--profile name` | Use a specific AWS profile |
| `--severity critical,high` | Filter by severity level |

## Output

The scanner will:
1. Run Prowler and save raw OCSF output to `.compliance/scans/`
2. Create individual finding files in `.compliance/findings/`
3. Print a summary of results by severity
4. Report how many noise findings were filtered out

From prajapatimehul/comp-agent, MIT.

More from prajapatimehul/comp-agent