Loading ToolBench
Security scanner for AI Agent skills, plugins, and MCP servers exposed as MCP tools
Prism Scanner has well-structured tool definitions with clear, descriptive names and comprehensive descriptions (150-250 chars each). All four tools have proper input schemas with typed properties and enums where appropriate. However, output schemas are not documented, LLMs cannot predict response structure for downstream planning. Parameter descriptions are present but lack detail on constraints (e.g., what constitutes a valid GitHub URL format, what 'auto-detected' means for platform). Error handling guidance is absent, tools do not indicate what failures are retryable or how to recover. The tool set is well-composed (each does one thing), but lacks idempotency guarantees and confirmation patterns for destructive operations like system cleanup.
Generate a cleanup plan for system residue found by prism_clean_scan. Shows what would be removed/fixed without making changes.
Scan the local system for residue left behind by uninstalled agent skills — LaunchAgents, crontab entries, shell config modifications, orphaned credentials, and more.
Quick security grade check for an agent skill, plugin, or MCP server. Returns only the letter grade (A-F) and recommendation, without full finding details. Fast for CI/CD gating.
Scan an AI agent skill, plugin, or MCP server for security risks. Accepts a local path or GitHub URL. Returns an A-F grade with detailed findings including malicious code detection, data exfiltration, persistence mechanisms, and supply chain risks.
Output schemas not documented. LLMs cannot predict response structure (fields, types, nesting) for downstream tool chaining or data extraction. prism_scan returns a complex object with grade, findings, behavior_tags, key_risks, none of this is declared in the tool definition.
Parameter descriptions lack actionable constraints. 'Local path or GitHub URL' does not specify format (e.g., must start with https://, absolute vs relative paths). 'Auto-detected if omitted' does not explain detection logic or fallback behavior. LLMs cannot validate inputs without explicit constraints.
No error handling guidance. Tools do not indicate which failures are retryable (network timeout vs invalid target), what recovery steps exist, or whether partial results are possible. An LLM receiving a failure has no next action.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | <=2025-11-25 | v2 |
prism_clean_scan and prism_clean_plan accept no parameters (empty properties object). This is unusual and suggests incomplete schema definition. If these tools scan 'the local system', what scope do they cover? Can they be filtered by user, directory, or age? Current schema is too vague.
No confirmation or dry-run pattern for destructive operations. prism_clean_plan generates a cleanup plan, but prism_clean_scan (or an implied execute tool) would modify system state (remove LaunchAgents, crontab entries, credentials). No tool requires confirmation before executing irreversible changes.