AI-Infra-Guard is an AI security red-teaming platform that scans agents, skills, MCP servers, and AI infrastructure and evaluates LLM jailbreak resistance. It is used to identify security risks and vulnerabilities in AI systems. Catalogue add-ons support its scanning and evaluation workflows.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Tencent/AI-Infra-Guard --skill edgeone-clawscangit clone --depth 1 https://github.com/Tencent/AI-Infra-GuardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tencent/ai-infra-guard/edgeone-clawscan)<a href="https://agentmods.dev/skills/tencent/ai-infra-guard/edgeone-clawscan"><img src="https://agentmods.dev/badge/skills/tencent/ai-infra-guard/edgeone-clawscan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tencent/ai-infra-guard/edgeone-clawscan"><img src="https://agentmods.dev/badge/skills/tencent/ai-infra-guard/edgeone-clawscan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high System Prompt Leakage · line 449 Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.Fix: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users.
- medium Excessive Agency · line 538 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00236 | $0.11141 |
| Opus 5 | $0.00118 | $0.05570 |
| Sonnet 5 | $0.00047 | $0.02228 |
| Haiku 4.5 | $0.00024 | $0.01114 |
Grade A, and why
edgeone-clawscan scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
external_requests above. All curl commands use this variable so the How it starts
The opening of the file, as written. The whole thing — 802 lines — stays where its author put it; the contents beside it link to each section on GitHub.
说明：本 Skill 由腾讯朱雀实验室出品，一键全面扫描 OpenClaw 不安全配置、恶意 Skill 与漏洞。 关于云端 API：供应链与 CVE 情报需要持续更新，仅靠本地静态文件无法覆盖「安装后被篡改的技能」与「每日新增的漏洞库」；因此默认会向 A.I.G 发起最小化查询（仅 skill 名+来源标签、以及 OpenClaw 版本号），不会上传 Skill 源码、对话或工作区文件。若策略不允许任何外联，请设置
AIG_CLOUD_LOOKUP=off做纯本地扫描，或把AIG_BASE_URL指向自建实例。 安装前请对照官方仓库核验来源；集市「所有者」字段可能与本文author不一致，不代表密码学意义上的发布者证明。
edgeone-clawscan
OpenClaw security scanning powered by AI-Infra-Guard ( https://github.com/Tencent/AI-Infra-Guard ).
Configuration
AIG_BASE_URL (optional) — base URL for the AI-Infra-Guard API.
Defaults to https://matrix.tencent.com/clawscan (the public Tencent endpoint
declared in the external_requests metadata above).
Privacy / air-gapped environments: to avoid sending skill names, source
labels, or version strings to the public Tencent host, use one of: (1)
AIG_BASE_URL pointing at a self-hosted AI-Infra-Guard you operate, or (2)
AIG_CLOUD_LOOKUP=off so no A.I.G HTTPS request runs (fully local Step 2
and Step 3). Curl uses
${AIG_BASE_URL:-https://matrix.tencent.com/clawscan} only when cloud lookup
is enabled.
export AIG_BASE_URL=https://your-self-hosted-aig.example.com/clawscan
export AIG_CLOUD_LOOKUP=off
Security Declaration
This section is an upfront disclosure of every network action and live probe this skill performs. Auditors and end users should read this section before installation or execution against production data.
Pre-run Safety Checklist
| # | Check | Action |
|---|---|---|
| 1 | Publisher vs registry | author here may not match marketplace "owner" text — see YAML provenance.registry_metadata_caveat. Verify against official_repo before trusting cloud verdicts. |
| 2 | Binary on PATH | which openclaw must resolve to the intended OpenClaw build. |
| 3 | Outbound policy | Default sends minimal metadata to Tencent A.I.G (tables below). For zero outbound: AIG_CLOUD_LOOKUP=off. For your own infra only: self-hosted AIG_BASE_URL. |
| 4 | Live probe | --deep hits the local Gateway config; avoid production until exposure is reviewed. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 802 lines · 236 tokens per session scan A caf92b77f6b1
edgeone-clawscan is a skill published in the GitHub repository Tencent/AI-Infra-Guard (6,221 stars, last pushed today), licensed Apache-2.0. It adds 236 tokens to every session and 11,141 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
edgeone skill scanner
A local security scanner for checking coding-agent skills before installation or use. It uses static analysis, which examines files without running them, and keeps file contents and credentials on your device.
audit
On-demand security and code quality audit. Use when checking for vulnerabilities, security issues, code smells, or compliance problems. Trigger keywords - "audit", "security check", "vulnerability scan", "code quality", "compliance", "security audit".
security-audit
A security review of code, application settings, and dependencies for common weaknesses such as injection attacks, broken access controls, exposed secrets, and unsafe libraries.
Vulnerability Scanning & Assessment
Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting.
hermes-self-evaluation
Use this skill when the user asks to audit, review, or optimize Hermes's own performance — analyzing session data, skills, configuration, costs, and usage patterns to identify improvements, automation opportunities, and system optimizations.
cortex-mem-mcp
Persistent memory enhancement for AI agents. Store conversations, search memories with semantic retrieval, and recall context across sessions. Use this skill when you need to remember user preferences, past conversations, project context, or any information that should persist beyond the current session. Provides…