Skip to content
Get packs

Edgeone Skill Scanner

Scans other agent skills for security risks before you install or run them.

Source Download skill
Repository
Tencent/AI-Infra-Guard
Stars
7,320
Licence
Apache-2.0
Files
1 file

What it does

This skill teaches an AI agent to act as a security checker for other agent skills. When you ask it to check whether a skill is safe, it reads the skill's files (SKILL.md and any scripts or config files), looks for signs of malicious behaviour, excessive permissions, privacy access, high-risk operations and hardcoded secrets, and then writes a report card for each skill. It is branded as Tencent Zhuque Lab's A.I.G (AI-Infra-Guard) scanner, and the instructions say the analysis is static, meaning it reads files rather than running them.

Great for

  • People who are about to install a third-party agent skill and want a second opinion before trusting it
  • Teams reviewing which skills are installed on their coding agent or platform
  • Security-minded users who want a quick structured audit of a skill's claimed purpose versus what its code actually does

Skip it if

  • Relying on it as a complete guarantee of safety: it is an LLM following written instructions, so it can miss issues, and the report is only as reliable as the agent running it
  • Scanning skills whose contents you have not authorised the agent to read, since it reads the files on your device
  • General debugging, system health checks or normal development, which its own description says should not trigger it

Try asking

  • “Is this skill safe to install? Here is the folder path: ~/Downloads/some-skill”
  • “Audit skill ./skills/data-export before I enable it”
  • “Scan all skills on my Claude Code setup for security risks”
  • “Check skill safety for the skill I just cloned from GitHub”
Step-by-step guide: how to use Edgeone Skill ScannerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    edgeone-skill-scanner.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip edgeone-skill-scanner.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip edgeone-skill-scanner.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Point it at a specific skill folder rather than asking for a full-platform scan, so the audit is focused and easier to review.
  • Treat the verdict as a starting point: read the flagged lines yourself, especially any scripts, before deciding to install.
  • Ask in plain language (for example 'audit skill') and check the report lists which files were read.

What's inside

  • SKILL.md

Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.