Prowler Studio

Prowler Studio

AI workflow that ensure Claude Code to follow Prowler's skills, guardrails, and best practices when creating new security checks. So what lands in your PR is consistent, tested, and ready for human review instead of half-correct boilerplate you have to rewrite.
Note: Looking for the old Prowler Studio? It's archived in the old-version branch.

The Problem

Adding a new check to Prowler is more than writing detection logic. A correct check has to:

- Match Prowler's exact service/check folder structure and naming conventions
- Wire up metadata, severity, remediation, tests, and compliance mappings
- Mirror the patterns used by the hundreds of existing checks in the same provider
- Actually load when Prowler scans for available checks — silent structural mistakes are easy to make

Asking a general-purpose AI assistant to do this usually means guessing. It misses conventions, skips tests, or invents structure that looks right but won't load. You end up reviewing a half-correct PR or rewriting it yourself.

The Solution

Prowler Studio enforces the workflow end-to-end. You describe the check once (a markdown ticket, a Jira issue, or a GitHub issue) and the workflow:

1. Loads Prowler-specific skills into every agent: every step starts with the same context an experienced Prowler engineer would have in mind.
2. Runs specialized agents in sequence: implementation → testing → compliance mapping → review → PR creation. Each agent has one job and a tight scope.
3. Verifies as it goes: the check must load in Prowler. Tests must pass. If something fails, the agent fixes it and re-runs (up to a bounded number of attempts) before moving on.
4. Produces a complete PR: branch, passing check, tests, compliance mappings, and a pull request waiting for human review.

The…