Prism Scanner — AI Agent Skill Security Scanner
Open-source static security scanner that detects malicious code in AI Agent skills, plugins, and MCP servers before you install them — and cleans up system residue after you uninstall.
SKILL.md declares restrained tools (Read/Grep/Glob/Bash); scanning is static and never executes scanned code; destructive clean --apply is gated by scan→plan→apply→rollback with backups per docs. Deducted: confirmation mechanics for destructive cleanup are only described, publisher unverified, pip dependency not audited here, rollback reliability unverified without execution.
Repository has real CI (multi-OS/Python matrix), committed test suite with fixtures, consistent pyproject metadata (SKILL.md version 0.1.0 lags 0.2.2). Deducted: static review cannot execute; SKILL.md version stale; changelog admits historically severe false-positive rates, so failure/edge behavior rests on documentation claims only.
Trigger phrases explicit including Chinese, scenarios (pre-install vetting, supply chain, residue cleanup) clear, platforms and offline mode declared. Deducted: false-positive/non-fit boundaries (binaries, obfuscation evasion) thinly disclosed; GitHub-dependent remote scanning with no mainland-China reachability discussion.
Well-layered docs (SKILL.md→README→CONTRIBUTING/SECURITY), Apache-2.0, structured changelog, complete pyproject, stated ownership. Deducted: SKILL.md version mismatch with pyproject; README badge test counts (40 vs 81 vs 97) contradict each other and the changelog; cited research/leak links look placeholder-like (wired.com homepage, future-dated article).
Core task flow complete with multiple output formats and differentiation from black-box trust scores. Deducted: output correctness unverifiable statically; changelog admits heavy false positives on real skills (e.g. 211→18), so 'A = safe' conclusions need human review — marginal value over manual inspection not demonstrated.
Real CI workflow plus committed tests covering main engine paths and auditable fixtures meets the static ceiling of 5. Deducted: no independent reproduction; external corroboration links incomplete; coverage of all 41 rules not shown.
- SKILL.md frontmatter (v0.1.0, 39 rules) lags pyproject (v0.2.2, 41 rules) — docs are out of sync; verify the installed version before use.
- Changelog admits historically severe false positives on real ClawHub skills (211→18 findings); do not treat an A/B grade as the sole safety signal — always review manually.
- prism clean --apply deletes system files; always run --plan first, review the cleanup list, and confirm backups exist.
- README test-count badges (40/81/97) contradict each other and cited research/leak links are incomplete; treat marketing claims as unverified.
- Remote scanning requires GitHub access and may be unreachable from mainland-China networks; prefer --offline mode for local targets.
- Publisher is unverified by FollowSkills (identity unknown); this is not itself a deduction, but treat supply-chain origin accordingly.
What does this skill do, and when should you use it?
Prism Scanner is an open-source (Apache 2.0) command-line tool that vets AI Agent skills, plugins, and MCP servers for security risks. It uses pure static analysis — it never executes scanned code — and applies 39+ detection rules across three layers: code behavior, metadata, and system residue. Findings are summarized in an A–F letter grade, with D or F meaning you should not install. It also scans for and safely cleans up persistence leftovers (LaunchAgents, crontab, shell config changes) after uninstalling, and integrates as an MCP server, GitHub Action, or Docker image.
Runs prism scan on a local directory, GitHub URL, or package (ClawHub, MCP, npm, pip), performing AST-based behavior analysis (S1-S14: shell execution, data exfiltration, persistence, intra-file taint tracking), regex/manifest metadata analysis (M1-M6, P1-P9: hardcoded credentials, typo-squatting, obfuscated payloads, prompt injection), and a residue engine (R1-R10: LaunchAgents, crontab entries, shell config pollution). Produces a graded verdict (A–F) with JSON, HTML, or SARIF output; --fail-on gates CI on severity. prism clean --scan/--plan/--apply performs a three-tier residue cleanup with automatic backup and rollback. It can also run as an MCP server exposing four tools: prism_scan, prism_grade, prism_clean_scan, prism_clean_plan.
- A developer about to install a new skill from ClawHub, GitHub, npm, or PyPI wants a pre-install safety check for malicious code
- A security engineer gates CI/CD pipelines using SARIF output and --fail-on high so high-severity findings fail the build
- A user who uninstalled a skill wants to verify no LaunchAgents, crontab entries, or shell config pollution remain on the system
- A team vetting a third-party MCP server or plugin wants code-level, rule-by-rule transparency instead of a black-box marketplace rating
- Detecting psychological manipulation patterns (P10) — gaslighting, authority impersonation, urgency pressure — embedded in skill descriptions or prompt strings
What are this skill's strengths and limitations?
- Pure static analysis — never executes scanned code; offline mode available
- Full lifecycle coverage (pre-install code analysis, post-uninstall residue cleanup) across ClawHub, MCP, npm, and pip
- 41 rules including taint analysis, plus claimed detection of prompt psychological manipulation (P10) and publish hygiene issues (M7)
- Rich output formats: terminal, JSON, HTML, SARIF — plugs directly into GitHub Code Scanning
- Apache 2.0 open source with YAML-defined rules that can be extended without touching Python
- Version inconsistencies in the source material (README badge says 0.2.2, SKILL.md says 0.1.0, sample output says 0.1.0); the 39-rule count in the description conflicts with the 41 rules claimed for v0.2.x
- Inherent static-analysis limits: behavior triggered only at runtime goes undetected; taint tracking is intra-file only
- Custom rule schema is only described at the directory level; field-level documentation of the YAML format is not provided
- The claimed 40 passing tests cannot be independently verified from the material — no linked CI status
How do you install this skill?
pip install prism-scanner (requires Python 3.10+). macOS alternative: brew tap prismlab/tools && brew install prism-scanner; or run without installing via npx prism-scanner. MCP mode: pip install "prism-scanner[mcp]", then add an mcpServers entry to your Claude Desktop config or run claude mcp add prism-scanner prism-mcp for Claude Code. A Docker image (ghcr.io/prismlab/prism-scanner) and an official GitHub Action (aidongise-cell/prism-scanner@main) are also available.
How do you use this skill?
After installing, run prism scan <path-or-github-url>; use --platform clawhub|mcp|npm|pip to target a platform, --format /html/sarif for output, -o for the report file, and --fail-on to set the CI failure threshold. For cleanup: prism clean --scan to report residue, --plan for a non-destructive plan, --apply to execute with backups (--rollback supported). In an agent, trigger it with prompts like "scan this skill" or "is this plugin safe to install?". Use .prismignore to suppress known findings by rule ID and --offline to skip external lookups.