Add Prism Scanner to Ecosystem Tools section#609
Add Prism Scanner to Ecosystem Tools section#609aidongise-cell wants to merge 1 commit intoaffaan-m:mainfrom
Conversation
📝 WalkthroughWalkthroughA new section documenting Prism Scanner—an open-source security scanner for AI Agent skills, plugins, and MCP servers—has been added to the README.md between the AgentShield and Plankton sections, including installation instructions, scanning capabilities, and output formats. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Greptile SummaryThis PR adds a single-entry documentation change to Key observations:
Confidence Score: 4/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Developer] -->|Local config audit| B[AgentShield]
A -->|Pre-install scan| C[Prism Scanner]
A -->|Write-time quality| D[Plankton]
B --> B1[CLAUDE.md\nsettings.json\nhooks / MCP configs]
C --> C1[Third-party skills\nplugins\nMCP servers]
C1 --> C2{39+ Detection Rules\nAST taint tracking\nSignature matching}
C2 --> C3[A-F Grade\nJSON / HTML / SARIF report]
C3 --> C4[Post-uninstall\nresidue cleanup]
D --> D1[Formatters + 20+ linters\non every file edit]
Last reviewed commit: "Add Prism Scanner to..." |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| prism scan https://github.com/user/some-skill | ||
| ``` | ||
|
|
||
| **What it scans:** Agent skills, plugins, and MCP servers across ClawHub, npm, and pip with 39+ detection rules — AST-level taint tracking, malicious signature matching, metadata analysis, and post-uninstall system residue detection. |
There was a problem hiding this comment.
The description mentions ClawHub as a platform Prism Scanner indexes, alongside npm and pip. ClawHub does not appear to be a widely-known or publicly documented platform in the AI-agent/MCP ecosystem. Including it in marketing copy alongside established registries (npm, pip) without a link or explanation may confuse readers or overstate the tool's coverage.
Consider either linking to the ClawHub platform (e.g. [ClawHub](https://clawhub.io)) or removing the reference if it is a placeholder / under-development registry.
| **What it scans:** Agent skills, plugins, and MCP servers across ClawHub, npm, and pip with 39+ detection rules — AST-level taint tracking, malicious signature matching, metadata analysis, and post-uninstall system residue detection. | |
| **What it scans:** Agent skills, plugins, and MCP servers across npm and pip with 39+ detection rules — AST-level taint tracking, malicious signature matching, metadata analysis, and post-uninstall system residue detection. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Around line 499-513: Add the Apache-2.0 license information to the README for
prism-scanner: insert an SPDX short identifier and a visible license badge and a
short "License" section (mentioning Apache License 2.0 with a link to the full
text) near the project title/links, and ensure the README references the same
Apache-2.0 wording shown in the repository (so README.md, the prism-scanner
project name, and the existing GitHub/PyPI links reflect the licensed status).
| Open-source security scanner for AI Agent skills, plugins, and MCP servers. Complements AgentShield (which focuses on your local Claude Code config) by scanning third-party code *before* you install it. | ||
|
|
||
| ```bash | ||
| pip install prism-scanner | ||
| prism scan https://github.com/user/some-skill | ||
| ``` | ||
|
|
||
| **What it scans:** Agent skills, plugins, and MCP servers across ClawHub, npm, and pip with 39+ detection rules — AST-level taint tracking, malicious signature matching, metadata analysis, and post-uninstall system residue detection. | ||
|
|
||
| **Grading:** A-F letter grades with severity breakdown and actionable recommendations. | ||
|
|
||
| **Output formats:** Terminal, JSON, HTML, SARIF (GitHub Code Scanning integration). | ||
|
|
||
| [GitHub](https://github.com/aidongise-cell/prism-scanner) | [PyPI](https://pypi.org/project/prism-scanner/) | [MCP Server](https://mcp.so/server/prism-scanner) | ||
|
|
There was a problem hiding this comment.
Add the Prism Scanner license to match the documented PR intent.
The new block omits the license detail (Apache 2.0), which is useful trust/compliance context for security tooling.
✏️ Proposed docs patch
Open-source security scanner for AI Agent skills, plugins, and MCP servers. Complements AgentShield (which focuses on your local Claude Code config) by scanning third-party code *before* you install it.
+License: Apache 2.0.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@README.md` around lines 499 - 513, Add the Apache-2.0 license information to
the README for prism-scanner: insert an SPDX short identifier and a visible
license badge and a short "License" section (mentioning Apache License 2.0 with
a link to the full text) near the project title/links, and ensure the README
references the same Apache-2.0 wording shown in the repository (so README.md,
the prism-scanner project name, and the existing GitHub/PyPI links reflect the
licensed status).
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="README.md">
<violation number="1" location="README.md:512">
P2: User-facing docs now instruct users to install/run an external tool from an unvetted third-party repo/package, which violates the team policy to avoid linking to unapproved external repositories in docs (supply-chain risk).</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
|
|
||
| **Output formats:** Terminal, JSON, HTML, SARIF (GitHub Code Scanning integration). | ||
|
|
||
| [GitHub](https://github.com/aidongise-cell/prism-scanner) | [PyPI](https://pypi.org/project/prism-scanner/) | [MCP Server](https://mcp.so/server/prism-scanner) |
There was a problem hiding this comment.
P2: User-facing docs now instruct users to install/run an external tool from an unvetted third-party repo/package, which violates the team policy to avoid linking to unapproved external repositories in docs (supply-chain risk).
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 512:
<comment>User-facing docs now instruct users to install/run an external tool from an unvetted third-party repo/package, which violates the team policy to avoid linking to unapproved external repositories in docs (supply-chain risk).</comment>
<file context>
@@ -494,6 +494,23 @@ Use `/security-scan` in Claude Code to run it, or add to CI with the [GitHub Act
+
+**Output formats:** Terminal, JSON, HTML, SARIF (GitHub Code Scanning integration).
+
+[GitHub](https://github.com/aidongise-cell/prism-scanner) | [PyPI](https://pypi.org/project/prism-scanner/) | [MCP Server](https://mcp.so/server/prism-scanner)
+
### 🔬 Plankton — Write-Time Code Quality Enforcement
</file context>
1 participant
Summary
Adds Prism Scanner to the Ecosystem Tools section alongside AgentShield and Plankton.
(Previous PR #562 incorrectly placed the entry in the v1.6.0 changelog. This PR puts it in the right section.)
Prism Scanner complements AgentShield by focusing on a different attack surface:
Key features:
Install:
pip install prism-scannerSummary by cubic
Added
prism-scannerto the Ecosystem Tools section of the README as a supply-chain security scanner for third‑party agent skills, plugins, and MCP servers. Includes install and quick usage example, key features (39+ rules, A–F grading, residue cleanup), supported outputs (terminal/JSON/HTML/SARIF), and links to GitHub, PyPI, and its MCP server.Written for commit 02c1080. Summary will update on new commits.
Summary by CodeRabbit
Documentation