[splunkenizer]

Summary

• spa licenses and spa aws --validate return a short JSON result when an agent is detected, and the full objects with --details. --no-agent stays human text.
• Validate warns when a named security group allows 0.0.0.0/0 or ::/0 to ports 22, 80, 8000, 8088, or 8089, without dumping the group rules.
• An agent run prints one plain line when the phase changes and does not repeat it on the heartbeat. splunk_download says the host downloads the tarball when the flag is true and the controller uploads it from Software when the flag is false.

Related to #67. This does not finish the skills pack, so the issue and the ROADMAP checkbox stay open.

Test plan

• ./tests/run_local_tests.sh (1391 passed, 72 deselected)
• Detected-agent spa licenses and spa aws return compact JSON; --no-agent stays text
• World-open security group produces one warning and no rule dump; a private range adds no warnings key
• Agent phase change is one plain line; a second heartbeat does not repeat it; a failed phase still prints a failure line

Made with Cursor