TencentAI-Infra-Guard, abbreviated A.I.G, is a self-hosted red-teaming platform for AI systems. It scans AI infrastructure, agent workflows, MCP servers, and agent skills for security risks, and reports them through a web interface, an HTTP API with Swagger documentation, or standalone command-line scanners for skills, MCP, and agents.
Six scanners make up the platform. ClawScan evaluates an OpenClaw installation for insecure configuration, risky skills, known vulnerabilities, and privacy leakage. Agent Scan is a multi-agent framework that probes agent workflows, including agents running on platforms such as Dify and Coze. The MCP and skill scanner detects 14 categories of risk in MCP servers and agent skills, from source code or a remote URL. The infrastructure scanner fingerprints over 100 AI framework components against more than 2,000 known CVE rules. Jailbreak evaluation tests prompt robustness with curated datasets and several attack methods, including the multi-turn Many-Shot, PAIR, GOAT, and ActorAttack techniques, and compares results across models. The model and API relay checker covers model fingerprinting, signature verification, and black-box relay auditing.
Skill findings map to the SkillTrustBench T01–T09 taxonomy: skill instruction hijacking and memory poisoning, remote payload download and execution and embedded malicious code, privilege escalation and system persistence, tool hijacking and spoofing and insecure dependencies, and insecure coding practices. The skill scanner installs as a Python package for use in a continuous-integration pipeline, and its measured accuracy on that benchmark varies by the judging model.
| Judging model | F1 | Precision | Recall | False-positive rate |
|---|---|---|---|---|
| Claude Opus 4.6 | 0.9848 | 0.9725 | 0.9974 | 0.0663 |
| GLM 5.1 | 0.9836 | 0.9701 | 0.9974 | 0.0723 |
| Gemini 3.5 Flash | 0.9792 | 0.9947 | 0.9641 | 0.0120 |
| Kimi 2.6 | 0.9780 | 0.9895 | 0.9667 | 0.0241 |
| DeepSeek v4 Flash | 0.9740 | 0.9868 | 0.9615 | 0.0301 |
Deployment is by Docker Compose against pre-built images or a source build, needing Docker 20.10 or later, 4 GB of memory, and 10 GB of disk, with the interface on port 8088. The platform is intended for internal use inside an organisation: it carries no authentication mechanism and is not meant to be exposed on a public network. Version 4.6.0 added LLM API poisoning detection as a multi-probe black-box audit for model substitution and backdoor risks, and expanded the vulnerability library to 146 AI components and more than 2,000 CVE rules.
Features
- ClawScan: one-click evaluation of an OpenClaw deployment for insecure configuration, skill risk, CVEs, and privacy leakage
- Agent Scan: a multi-agent scanning framework for agent workflows, with a mutation engine and web-exfiltration detection
- MCP and skill scanning: 14 risk categories detected from source code or a remote URL, with tool whitelisting to prevent remote code execution in dynamic mode
- Skill risk taxonomy: findings classified against SkillTrustBench T01–T09 across instruction, execution, privilege, dependency, and code-quality layers
- Bytecode and charset checks: .pyc bytecode bypass detection and charset smuggling defence in the skill scanner
- Infrastructure scanning: fingerprints more than 100 AI framework components, including Ollama, ComfyUI, vLLM, n8n, and Triton Inference Server, against 2,000-plus CVE rules
- Jailbreak evaluation: curated datasets and multi-turn attacks with cross-model comparison
- Relay checker: model fingerprinting, signature verification, and black-box auditing of API relays via /api/v1/relay/check/stream
- CI-ready CLI: aig-skill-scan runs against a local skill directory and writes JSON results, with a model and output language selectable per run
- Agent skills: scanner skills published on ClawHub so scanning can be triggered from an agent conversation
