Skip to main content
Prowler Studio is an AI workflow that ensures Claude Code follows Prowler’s skills, guardrails, and best practices when creating new security checks. What lands in the resulting pull request is consistent, tested, and ready for human review — not half-correct boilerplate that needs to be rewritten.
Contributor Tool: Prowler Studio is a workflow for advanced contributors adding new Prowler security checks. It is not part of Prowler Cloud, Prowler Local Server, or Prowler CLI.
Preview Feature: Prowler Studio is under active development and breaking changes are expected. Please report issues or share feedback on GitHub or in the Slack community.

Prowler Studio Repository

Clone the source code, install Prowler Studio, and explore the agent workflow in detail.

​
The Problem

Adding a new check to Prowler is more than writing detection logic. A correct check has to:
  • Match Prowler’s exact service and check folder structure and naming conventions
  • Wire up metadata, severity, remediation, tests, and compliance mappings
  • Mirror the patterns used by the hundreds of existing checks in the same provider
  • Actually load when Prowler scans for available checks — silent structural mistakes are easy to make
Asking a general-purpose AI assistant to do this usually means guessing. It misses conventions, skips tests, or invents structure that looks right but does not load. The result is a half-correct PR that needs to be reviewed line by line or rewritten.

​
The Solution

Prowler Studio enforces the workflow end-to-end. Describe the check once — a markdown ticket, a Jira issue, or a GitHub issue — and the workflow:
  1. Loads Prowler-specific skills into every agent. Every step starts with the same context an experienced Prowler engineer would have in mind. See AI Skills System for how skills are structured.
  2. Runs specialized agents in sequence. Implementation → testing → compliance mapping → review → PR creation. Each agent has one job and a tight scope.
  3. Verifies as it goes. The check must load in Prowler. Tests must pass. If something fails, the agent fixes it and re-runs (up to a bounded number of attempts) before moving on.
  4. Produces a complete pull request. Branch, passing check, tests, compliance mappings, and a pull request waiting for human review.
The result is a consistent starting point, every time, on every supported provider.

​
Quick Start

​
Install

Prowler Studio requires uv — see the official installation guide.

​
Describe the Check

A ticket is a structured markdown description of the check to create. It is the only input the workflow needs; every agent (implementation, testing, compliance mapping, review, PR creation) uses it as the source of truth, so the more concrete it is, the closer the first PR will land to the desired outcome. The ticket can be supplied in three ways:
  • Local markdown file → --ticket path/to/ticket.md
  • Jira issue → --jira-url https://... (uses the issue body)
  • GitHub issue → --github-url https://... (uses the issue body)
The content should follow the New Check Request template: Sections marked Optional can be skipped; everything else helps the agents make the right decisions.

​
Run the Workflow

From a local markdown ticket:
From a Jira ticket:
From a GitHub issue:
Provide exactly one of --ticket, --jira-url, or --github-url.
Keep changes local (no push, no pull request):

​
What You Get

After a successful run the working environment contains:
  • A new branch on a clean Prowler worktree containing the check, metadata, tests, and compliance mappings
  • A pull request opened against Prowler (skipped with --local)
  • A timestamped log file under logs/ capturing every step the agents took

​
CLI Options

​
Configuration

Set these environment variables depending on the input source: