Prism: Plugin-Based Red Team Agent for Autonomous Asset Mapping and Vulnerability Verification

Background

As large-model agents advance, security practitioners are applying them to red-blue exercises and penetration testing. General-purpose agents excel at conversation, code generation, web browsing, and tool invocation, but red-team tasks require more than simply letting a model run a few security tools. Steps such as asset discovery, fingerprint identification, vulnerability assessment, result verification, risk prioritization, and reporting are interdependent and rely on continuous feedback. The core challenge is keeping an agent in a long-term usable state throughout a security engagement.

Exploration Based on Coding Agents

2.1 Agent Architecture Analysis

The article analyzes Claude Code architecture as a runtime-driven loop execution system. After user input, the runtime assembles system prompts, project rules, history, tool descriptions, and environment info into the model's working context. The model then enters a main loop: decide to reply, plan, or call a tool. Each tool call passes a permission check, executes via the runtime, and writes results back to context for the next iteration. This continues until task completion or context compression when nearing limits. The model handles understanding and decision-making; the runtime manages context, tool scheduling, permission control, and loop management.

Mature agent runtimes already solve common problems:

Session and context lifecycle

Model invocation and streaming responses

Tool registration, invocation, and result write-back

Permission confirmation and execution control

Long-task loops, compression, and recovery

Sub-task or sub-agent extension interfaces

2.2 Prism 1.0

Prism 1.0 envisioned adding a red-team-oriented collaboration layer atop the agent to better accomplish adversarial tasks.

Agent Runtime

The runtime uses a continuous-feedback task-advancement loop:

Think : Combine user goal, current state, and historical results to decide the next task.

Act : Select MCP services, skill libraries, or collaborative agents to execute concrete actions.

Observe : Read results and write new content into shared state.

Re-think : Adjust strategy based on state and decide subsequent operations.

Observation Correction operates outside the main agent loop as an evaluation mechanism. It continuously consumes session, tool, and state events to detect repeated attempts, task drift, and abnormal termination, offering correction suggestions; it can directly end the agent loop when issues are severe.

Security Tools

The tool layer enables rapid integration of common security tools:

Unified Interface : Standardize tool parameters and return values, avoiding loose unstructured text passing between tools.

Execution Governance : Scope judgment and human approval by operation risk to prevent destructive actions.

Standardization : Process tool output and write to shared state.

Shared State

The shared state center serves as structured "working memory" for a red-team task, composed of six object types (illustrated in the article's diagram).

Data Precipitation

Cross-task reuse is achieved by condensing reviewed information into four long-term data categories after task or phase completion:

Knowledge : CVEs, vulnerability knowledge, exploitation conditions, tool usage, methodologies, and TTPs.

Experience : Effective paths, failure cases, false-positive patterns, environmental constraints, and target characteristics.

Asset : Organizations, domains, IPs, technical fingerprints, topology, tags, and historical changes.

Ops : Task reports, vulnerability lists, evidence chains, timelines, and report output records.

Data precipitation must retain source, collection time, confidence, applicability scope, and sensitivity level, with continuous governance via deduplication, review, and archiving strategies.

Result Export

Four deliverable types are generated from shared state:

Attack surface report summarizing assets, services, risks, and potential paths

Vulnerability report describing vulnerability, impact, evidence, reproduction conditions, and remediation advice

Evidence attachments preserving requests, responses, logs, screenshots, and files

Visualizations of asset topology and risk dashboards

Plugin-Based Implementation on DeepSeek Harness

3.1 DeepSeek Harness

Based on the official DeepSeek Harness Architecture documentation (https://deepseek.com/harness). DeepSeek Harness is built on Cordis. At startup, the Profile overlays Bundles, user patches, and external plugins into an actual plugin tree; sessions, system prompts, tool registry, model adapters, and the agent loop are all mounted as plugins, allowing configuration-based composition, replacement, and cleanup on unload. Runtime operates on a Turn/Step closed loop: acquire input, assemble prompt and tool schemas, issue model request, execute pipeline, write results to SessionEvent.

3.2 Cordis Plugin System

Based on the official Cordis Tutorial (https://deepseek.com/harness). Cordis is a minimal runtime where every capability—tools, LLM adapters, file access, even the agent loop itself—is a plugin mounted to a shared context. A plugin declares capabilities (a tool, a prompt segment, a public service, or an event listener); cordis.yml and Profile Patch decide which plugins are assembled. Developing a plugin involves defining added capabilities, optional config schema, required inject dependencies, and registering in apply(ctx, config). Tools register to ctx.tools, prompts to ctx.systemPrompt, public capabilities to ctx.<key>.

3.3 Prism 2.0

Prism 2.0 is delivered as a single Cordis plugin @prism-ai/dsh-redteam with sidebar entry points. The plugin activates per session mode, registering relevant content only within that scope.

DeepSeek Harness handles the agent main loop, sessions, model calls, general tools, Skills, MCP, sandbox, and human approval. The Prism plugin only adds security-task adaptations.

Safety Guardrails consist of three layers:

Run mode determines usable permissions

Target scope determines testable targets

Tool list determines callable tools

All three must be satisfied before an operation proceeds; it still passes through DeepSeek Harness's own security policies. General Bash, file, web, and other MCP tools remain managed by Harness's native policies.

Prism Effects (Dashboard Walkthrough)

Verified on DeepSeek Harness version 0.1.2-alpha.5; source code at https://github.com/spkiddai/dsh-redteam. After deploying the plugin, select "Red Team Mode" in the agent preset list and associate the current workspace to enter the Prism dashboard.

4.1 Execution Permissions

The dashboard top bar sets execution permissions for Prism security tools in the current session, with four modes that progressively relax permissions.

4.2 Project Status

"Project Status" is the primary task entry point, grouping project overview, model metrics, information collection, target scope, vulnerability scanning, vulnerability verification, and result export.

Project Overview : Shows project name, ID, workspace, overall completion; export asset data, vulnerability details, or project report as Word, Markdown, or HTML.

Model Metrics : Input/output tokens, cache hit rate, cost consumption for run-cost evaluation.

Information Collection : (Note: article text duplicates model metrics description here; likely a copy-paste error in source.)

Target Scope : Uses public reconnaissance to discover assets layer by layer, writing nodes, relationships, and sources into the asset graph.

Vulnerability Scanning : Analyzes existing assets, services, and code to generate vulnerabilities.

Vulnerability Verification : Reproduces actual exploitation effects of confirmed vulnerabilities.

Session Dialog : All operations reuse the current Harness session, preserving history, reasoning, and tool results.

4.3 Asset Situation

Displays assets precipitated into the current project. Top section counts by domain, IP, port, service; bottom shows a relationship graph of asset associations.

Zoom controls adjust the graph. Node colors indicate processing status: green = no associated vulnerabilities, yellow = not yet tested, red = associated vulnerabilities.

4.4 Vulnerability Summary

Unified view of project risk results. Top shows total vulnerabilities and counts per four severity levels; bottom lists each vulnerability's title, location, severity, evidence, and handling status.

4.5 Tool Integration

Manages security tools allowed in the current project. Built-in tools include Nmap, Nuclei, Burp Suite, and Metasploit.

To use built-in tools, check desired tools and click "Confirm Selection"; mere checking without confirmation has no effect—unconfirmed tools are rejected server-side. Adding MCP extensions requires tool name, endpoint URL, and protocol choice (HTTP, SSE, or STDIO); actual callability depends on MCP services already connected in DeepSeek Harness. "Execution Details" shows tool execution status and return summaries; full process remains in Harness native tool cards.

4.6 Usage Flow

A complete Prism task proceeds as follows:

Select "Red Team Mode" in the workspace session.

In "Project Status", input assets and start information collection.

Based on the asset graph, check and confirm target scope.

In "Tool Integration", check tools and choose an appropriate permission mode.

In "Project Status", execute vulnerability scanning.

In "Vulnerability Verification" or "Full Allow" mode, re-verify confirmed vulnerabilities.

Review overall results in "Asset Situation" and "Vulnerability Summary".

Export assets, vulnerabilities, or project reports.

Future Evolution Plans

The article includes a roadmap image outlining planned enhancements (details not enumerated in text).

References

Claude Agent articles: https://code.claude.com/docs/

Claude Code: https://github.com/anthropics/claude-code

DeepSeek Harness articles: https://deepseek.com/harness

DeepSeek Harness source: https://github.com/deepseek-ai/deepseek-harness