**AI-Infra-Guard** (A.I.G) is an **Apache-2.0** AI red teaming platform from **Tencent's Zhuque Lab**, sitting at **5,530 stars and 521 forks** with the current release **v4.5.2** shipped on **17 August 2026**. Where most AI security tooling picks one layer — prompts, or dependencies, or the model itself — A.I.G's premise is that the attack surface of a deployed AI system now spans all of them at once, and tries to cover the whole stack from a single Docker deployment reachable at `localhost:8088`. Six scanners sit behind that interface. **AI infra vulnerability scan** fingerprints over **100 AI framework components** — Ollama, ComfyUI, vLLM, n8n, Triton Inference Server among them — against a library that v4.5.2 expanded past **2,000 CVE rules**. **MCP Server & Agent Skills scan** covers 14 categories of risk and works from either source code or a remote URL. **Agent Scan** is a separate multi-agent framework for evaluating agent workflows, with support for agents running on Dify and Coze. **ClawScan** targets OpenClaw deployments for insecure configuration, Skill risks, CVEs, and privacy leakage. **Jailbreak Evaluation** runs curated attack datasets with cross-model comparison, and v4.5.1 added four multi-turn attack methods — Many-Shot, PAIR, GOAT, and ActorAttack. A **Model and API Relay Checker** rounds it out with model fingerprinting, Claude Signature verification, and black-box relay auditing. The most substantive piece is the **Skill scanner**, which reflects how quickly agent skills became a real supply-chain surface. `aig-skill-scan` installs as a plain `pip` package and is built to drop into CI/CD, classifying findings against the **SkillTrustBench T01–T09** taxonomy across five layers: instruction and memory attacks (skill instruction hijacking, memory poisoning), code execution (remote payload download, embedded malicious code), system privilege (escalation, persistence), toolchain and dependencies (tool hijacking, insecure dependencies), and skill code quality. Because the scanner is LLM-driven, the README publishes its **SkillTrustBench** numbers per backing model rather than a single headline score — Claude Opus 4.6 leads on F1 at **0.9848** with **0.9974** recall but a **0.0663** false-positive rate, while Gemini 3.5 Flash trades recall (0.9641) for far better precision (0.9947) and a **0.0120** FPR. That FPR spread is the number to plan around: the highest-recall configuration is also the noisiest in a CI gate. The project is not new — it dates to December 2024 — but the last two releases show where the effort is going, and it is squarely toward agent-era threats rather than classic infrastructure CVEs. v4.5.2 added **.pyc bytecode bypass detection** and charset smuggling defense to Skill-Scan, plus RCE prevention through tool whitelisting in MCP-Scan's dynamic mode. v4.5.0 open-sourced the frontend, split Skill/MCP/Agent scanning into **standalone CLIs**, and launched an AI Security Skill Market. A.I.G has been presented at **Black Hat EU 2025 Arsenal**, and ships packaged skills on ClawHub so the scanners can be invoked from inside an agent workflow. Two constraints deserve emphasis before deployment. First, the maintainers state plainly that A.I.G is positioned for **internal enterprise or individual use, currently lacks an authentication mechanism, and should not be exposed on public networks** — an unauthenticated scanner reachable from the internet is itself a liability. Second, the Skill scanner requires an `LLM_API_KEY` and sends the scanned skill to a model provider, which is a meaningful consideration for proprietary code. There is also a Pro tier at aigsec.ai behind an invitation code, so the open-source build is not the full product, though the free version is genuinely comprehensive rather than a stripped demo.