When the workflow is started, the asset is already stored in the repository. So you need to consider the way the asset upload is performed. Starting with AEM 6.3 the file isn't streamed to a tempfile anymore but directly to the repo. But even in earlier versions the tempfile is an implementation detail, and you cannot use it to scan it.
If you want to scan all assets before uploading, you need to define a mandatory upload feature and disallow the out-of-the-box feature of uploading files via browser.
Jörg