How to use the aig-agent-redteam agent skill

What the skill makes the agent do

Once the skill is loaded, the agent works like a red-team specialist. It first maps the target's capabilities and trust boundaries, then proposes specific risk hypotheses, such as whether untrusted text could change the agent's goals or whether a tool could be used to reach data it should not touch. It tests each hypothesis with harmless canary markers instead of real secrets, adjusts its next attempt by changing one variable at a time, and writes a penetration-test-style report with the evidence behind each finding.

The skill's method is first-principles reasoning, not running a fixed list of attack prompts. The helper scripts only handle deterministic chores such as HTTP fingerprinting and merging results. The agent makes the security judgments.

• Covered risk areas: prompt injection, indirect injection, tool abuse, data leakage, privilege escalation, SSRF and outbound connections, supply-chain poisoning, and infrastructure exposure.
• Outputs: findings with evidence, business-language risk descriptions and fix suggestions, in HTML or Markdown.
• It can reuse fingerprint and vulnerability rule data from the Tencent AI-Infra-Guard project.

Install the aig-agent-redteam skill

Download the skill's ZIP file from the page where you found this guide, then unzip it. For a personal install, place the skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

The upstream README also lists an install through the npx skills tool, which requires node and git. Use it only if you are comfortable running that tool.

• Personal: ~/.claude/skills/aig-agent-redteam/
• Project: .claude/skills/aig-agent-redteam/ inside your project
• Claude apps: Settings → Capabilities → Skills → upload

Set up optional helper scripts and AIG data

The skill works without scripts, but some helpers need Python 3. The scripts are aig_data.py (which finds AI-Infra-Guard data), run.py (HTTP reachability and product fingerprinting) and aggregator.py (merges module results). The fingerprint and vulnerability rules come from the data/ directory of the tencent/AI-Infra-Guard repository. You can point the skill at a local clone, set AIG_DATA_DIR or AIG_ROOT, or allow it to download the repository into a temporary folder. If no AIG data is found, the skill falls back to a small built-in set of data.

• Python 3 is required only for the helper scripts.
• Checking your data setup: run the status command below and read which data directory it reports.
• If you have no clone and do not allow downloads, expect less fingerprint coverage.

Trigger the skill with a natural request

You do not need special syntax. Describe the goal in plain language and name the target. The skill is written to activate on requests about AI or agent security assessment, prompt-injection testing, MCP, skill or plugin audits, tool-chain abuse testing, and pentest-style reports.

Before it sends any test, the agent must know the target, how payloads reach it, how responses are observed, that you are authorized to test it, and the boundaries. For an external system, it will ask if any of these four items are missing: target, send method, observation method and authorization. If you say you are testing the current assistant itself, it can start without a separate send or observe method, while keeping the default safety limits.

• Good: "Audit this MCP server repo at ./mcp-files for paths where tool arguments reach shell or file writes. I own it and this is a local copy."
• Good: "Run an authorized prompt-injection test against our support chatbot at the staging URL. Send via its HTTP chat API and record full responses. Budget 50 payloads, measure mode."
• Good: "Red-team yourself: test whether you leak your system prompt when a document asks you to. Use only canary markers."

Understand the safety rules and limits

The skill is for systems you own or have written permission to test. The upstream guidance says probing other people's AI services is illegal and unethical. The skill also says it should not treat itself as a test target during normal runs, and it prefers harmless canaries, temporary files and local mock endpoints over real credentials or data.

The skill declares that it runs scripts and uses the network. Read the scripts before running them in a sensitive environment, and only allow real network requests to hosts you have approved. Dynamic tests against live production systems can expose data or cause side effects, so use a controlled environment first.

• Never test systems you do not own or lack written permission to test.
• Do not use it against production systems without a controlled environment.
• Default mode is measure, which runs to a payload budget and estimates results. Break mode, which tries to get through quickly, is used only when you ask for it.
• A dynamic test that goes ahead must send at least 30 payloads, including dataset samples and operator-mutated samples, and record the statistics.

Read the report and act on it

Each finding should have concrete evidence, such as a real conversation, a request and response, or a tool trace. Static suspicions in code are not counted as findings until reachability and impact have been checked. Reports are meant to describe business impact and fixes, and to show defences that worked as well as failures. AI-Infra-Guard rule matches only show that a rule matched. The agent still has to judge authentication, reachability, version confidence and business context before the risk is real.

• Rule matches from AI-Infra-Guard data are labelled as rule matches, not confirmed vulnerabilities.
• Self-tests are marked as self-observation, not independent verification.
• Reports can be generated from the bundled HTML template or in Markdown.