Skip to content
Get packs

AIG Agent Red-Team Drill

Guides an agent through authorized AI-security red-team tests and evidence-based reports

Source Download skill
Repository
Tencent/AI-Infra-Guard
Stars
7,320
Licence
Apache-2.0
Files
15 files

What it does

Once installed, the agent follows a structured method for authorized security testing of AI products, agents, MCP servers, skills and AI infrastructure. It maps capabilities and trust boundaries, proposes risk hypotheses, tests them with harmless canary markers, adapts its attempts one change at a time, and writes a penetration-test-style report with evidence. It can reuse fingerprint and vulnerability rule data from the Tencent AI-Infra-Guard project.

Great for

  • Security teams running authorized red-team exercises against their own AI agents or LLM apps
  • Developers auditing third-party MCP servers, skills or code packages before adoption
  • Teams that want an evidence-backed HTML or Markdown report of AI-specific risks

Skip it if

  • Testing systems you do not own or have written permission to test, since probing others' AI services is illegal and unethical
  • Casual users who only want general AI security advice; the skill is a detailed operational test procedure
  • Production systems where live adversarial payloads could cause data exposure or destructive side effects without a controlled environment

Try asking

  • “Run an authorized red-team exercise against my own customer support agent for prompt injection and data leakage, measure mode, budget 50”
  • “Audit this MCP server repository for supply-chain and tool-abuse risks and give me an HTML report”
  • “Test the current assistant itself for system prompt leakage using harmless canary strings”
  • “Fingerprint my self-hosted AI infrastructure and match it against known vulnerability rules”
Step-by-step guide: how to use AIG Agent Red-Team DrillInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 15 original files, the Apache-2.0 licence and an attribution note.

    aig-agent-redteam.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip aig-agent-redteam.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip aig-agent-redteam.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Define scope, allowed hosts and forbidden data before starting; the skill asks for these and will not attack external targets without them
  • Use canary markers and a local mock endpoint instead of real secrets, and review any script before running it
  • Treat AIG rule matches as leads only; confirm reachability, authentication and version before reporting a finding

What's inside

  • assets/templates/report.html
  • modules/code-attack/MODULE.md
  • modules/infra-attack/data/fingerprints/ai-agent-config.yaml
  • modules/infra-attack/data/fingerprints/ai-chatbot.yaml
  • modules/infra-attack/data/fingerprints/anythingllm.yaml
  • modules/infra-attack/data/fingerprints/bentoml.yaml
  • modules/infra-attack/data/fingerprints/blinko.yaml
  • modules/infra-attack/data/fingerprints/chat-langchain.yaml
  • modules/infra-attack/data/fingerprints/chuanhugpt.yaml
  • modules/infra-attack/data/fingerprints/clawdbot.yaml
  • modules/infra-attack/data/fingerprints/clickhouse.yaml
  • modules/infra-attack/MODULE.md
  • README.md
  • README.zh-CN.md
  • SKILL.md

Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.