AI-Infra-Guard (A.I.G) is an Apache-2.0 AI red teaming platform from Tencent's Zhuque Lab, sitting at 5,530 stars and 521 forks with the current release v4.5.2 shipped on 17 August 2026. Where most AI security tooling picks one layer — prompts, or dependencies, or the model itself — A.I.G's premise is that the attack surface of a deployed AI system now spans all of them at once, and tries to cover the whole stack from a single Docker deployment reachable at localhost:8088.

Six scanners sit behind that interface. AI infra vulnerability scan fingerprints over 100 AI framework components — Ollama, ComfyUI, vLLM, n8n, Triton Inference Server among them — against a library that v4.5.2 expanded past 2,000 CVE rules. MCP Server & Agent Skills scan covers 14 categories of risk and works from either source code or a remote URL. Agent Scan is a separate multi-agent framework for evaluating agent workflows, with support for agents running on Dify and Coze. ClawScan targets OpenClaw deployments for insecure configuration, Skill risks, CVEs, and privacy leakage. Jailbreak Evaluation runs curated attack datasets with cross-model comparison, and v4.5.1 added four multi-turn attack methods — Many-Shot, PAIR, GOAT, and ActorAttack. A Model and API Relay Checker rounds it out with model fingerprinting, Claude Signature verification, and black-box relay auditing.

The most substantive piece is the Skill scanner, which reflects how quickly agent skills became a real supply-chain surface. aig-skill-scan installs as a plain pip package and is built to drop into CI/CD, classifying findings against the SkillTrustBench T01–T09 taxonomy across five layers: instruction and memory attacks (skill instruction hijacking, memory poisoning), code execution (remote payload download, embedded malicious code), system privilege (escalation, persistence), toolchain and dependencies (tool hijacking, insecure dependencies), and skill code quality. Because the scanner is LLM-driven, the README publishes its SkillTrustBench numbers per backing model rather than a single headline score — Claude Opus 4.6 leads on F1 at 0.9848 with 0.9974 recall but a 0.0663 false-positive rate, while Gemini 3.5 Flash trades recall (0.9641) for far better precision (0.9947) and a 0.0120 FPR. That FPR spread is the number to plan around: the highest-recall configuration is also the noisiest in a CI gate.

The project is not new — it dates to December 2024 — but the last two releases show where the effort is going, and it is squarely toward agent-era threats rather than classic infrastructure CVEs. v4.5.2 added .pyc bytecode bypass detection and charset smuggling defense to Skill-Scan, plus RCE prevention through tool whitelisting in MCP-Scan's dynamic mode. v4.5.0 open-sourced the frontend, split Skill/MCP/Agent scanning into standalone CLIs, and launched an AI Security Skill Market. A.I.G has been presented at Black Hat EU 2025 Arsenal, and ships packaged skills on ClawHub so the scanners can be invoked from inside an agent workflow.

Two constraints deserve emphasis before deployment. First, the maintainers state plainly that A.I.G is positioned for internal enterprise or individual use, currently lacks an authentication mechanism, and should not be exposed on public networks — an unauthenticated scanner reachable from the internet is itself a liability. Second, the Skill scanner requires an LLM_API_KEY and sends the scanned skill to a model provider, which is a meaningful consideration for proprietary code. There is also a Pro tier at aigsec.ai behind an invitation code, so the open-source build is not the full product, though the free version is genuinely comprehensive rather than a stripped demo.