Prismer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:53 PM UTC
• Version: 1.7.4

Overview

This is a coherent cloud-integration skill, but it asks users to enable broad remote storage, messaging, file upload, plugin, and skill-install capabilities without enough scoping or provenance safeguards.

Install only if you are comfortable connecting the agent to Prismer Cloud for messaging, memory, file uploads, parsing, task state, and skill/plugin management. Review data before sending or storing it, avoid secrets and regulated content unless you have approval, pin package/plugin versions where possible, and manually review any skill installed with prismer skill install before letting an agent use it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: Skill.md:13
• Finding: Unpinned Third-Party Packages and Plugins May Execute Untrusted Supply-Chain Code## Vulnerability Details **File Location**: `Skill.md`, lines 13, 276–279, 325, and 329 **Vulnerability Type**: Unpinned third-party dependencies and plugins **Risk Level**: Medium ### Vulnerable Code ```bash which prismer || npm install -g @prismer/sdk ``` ```markdown | **Claude Code Plugin** | `/plugin marketplace add Prismer-AI/PrismerCloud` then `/plugin install prismer@prismer` | | **MCP Server** | `npx -y @prismer/mcp-server` (33 tools) | | **OpenCode Plugin** | `opencode plugins install @prismer/opencode-plugin` | | **OpenClaw Channel** | `openclaw plugins install @prismer/openclaw-channel` | ``` ```markdown | TypeScript | `@prismer/sdk` | `npm install @prismer/sdk` | ``` ```markdown | MCP Server | `@prismer/mcp-server` | `npx -y @prismer/mcp-server` (33 tools) | ``` ### Technical Analysis The documented commands install or execute third-party packages and agent plugins without pinned versions, lockfiles, checksums, or other integrity verification. Consequently, the code installed is the package version resolved by the registry or plugin marketplace at execution time rather than a specific version reviewed during this audit. The `npx -y @prismer/mcp-server` command is particularly sensitive because it automatically accepts installation and runs the resolved package. A global npm installation can also execute package lifecycle scripts with the invoking user's privileges. Agent plugins may receive access to local files, agent hooks, credentials available to the host process, messaging functions, memory facilities, or other configured tools. This is a supply-chain exposure rather than evidence that any named package is currently malicious. The reviewed project contains only documentation, so the implementation and integrity of the referenced external packages could not be verified. ### Attack Path 1. An attacker compromises a referenced npm package, plugin publisher account, marketplace entry, or future package release. 2. The compromised source ...[truncated 1289 chars]
• Remediation: ## Remediation Suggestions 1. Pin every npm dependency and executable to an explicitly reviewed version, for example `@prismer/sdk@X.Y.Z` and `@prismer/mcp-server@X.Y.Z`. 2. Use a project-local dependency with a committed lockfile instead of global installation or ad hoc `npx` execution. 3. Replace automatic `npx -y` execution with installation from a lockfile followed by invocation of the verified local binary. 4. Record and verify package integrity hashes where supported. 5. Pin plugin marketplace sources to immutable releases or commit identifiers and document publisher verification requirements. 6. Review package lifecycle scripts and plugin permissions before installation. 7. Run plugins and MCP servers with least privilege in a sandbox or isolated account, exposing only the files, credentials, network destinations, and agent tools required for their function. 8. Use dependency monitoring and periodically re-audit pinned versions before upgrading.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Self-Modification

High

• Category: Rogue Agent

Content

```bash
prismer skill find "evolution"                      # search catalog
prismer skill find -c repair                        # filter by category
prismer skill install <slug>                        # install + write SKILL.md locally
prismer skill list                                  # installed skills
prismer skill show <slug>                           # view skill content
prismer skill uninstall <slug>                      # uninstall

• Confidence: 95% confidence
• Finding: The skill supports `prismer skill install <slug>` which installs remote skill content and writes `SKILL.md` locally, enabling external instructions to be introduced into the agent environment. This is effectively a self-modification/content-ingestion primitive, and in the context of agent skills it is especially dangerous because newly installed skills can influence future agent behavior, prompt context, or tool usage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The messaging section omits a clear warning that message content, conversation history, tasks, and memory entries may be transmitted to and retained by a remote service. This is risky because agents may treat these commands as internal tooling and send sensitive prompts, code, customer data, or operational details without user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill describes uploading and sending files to a cloud service but does not clearly warn that file contents will leave the local environment and be stored or processed remotely. In an agent context, this can lead to inadvertent exfiltration of sensitive documents, credentials, proprietary code, or regulated data through normal-looking workflow commands.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs users to run an MCP server via `npx -y @prismer/mcp-server` without pinning a specific version. This creates a supply-chain risk because future or compromised package releases could be fetched and executed implicitly, and the risk is elevated here because MCP servers expose powerful agent-facing tools and are intended to be run locally.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The reference section again recommends `npx -y @prismer/mcp-server` without a fixed version, repeating the same unpinned remote-code execution pattern. Because this is presented as a canonical install command, users are likely to copy-paste it, increasing exposure to malicious or breaking upstream changes.

Static analysis

No suspicious patterns detected.