Tool Abuse Detection
Probes an AI agent's file, code, and network tools for misuse via scripted test prompts
- Repository
- Tencent/AI-Infra-Guard
- Stars
- 7,320
- Licence
- Apache-2.0
- Files
- 1 file
What it does
This skill tells an AI agent how to act as a security tester for another AI agent. It works out which tools the target agent has (file access, command or code execution, web requests), then sends it test prompts such as attempts to read /etc/passwd, run shell commands, or fetch a verification URL. It then judges whether the target agent complied and writes up any confirmed issues in a structured report format.
Great for
- Security teams auditing an AI agent before deploying it with file, shell, or web tools
- Developers who want to check that their agent refuses out-of-scope file reads, command execution, and URL fetches
- Reviewers producing a standardized vulnerability report for an agent under test
Skip it if
- Testing agents you do not own or have permission to test, since the prompts are designed to trigger unauthorized access and may be illegal or harmful against third-party systems
- Agents with no file, code, or network tools, where the skill itself says to skip it
- Anyone expecting a complete security audit; it only covers dialogue-based probes and does not inspect code or configuration
Try asking
- “Test my coding agent for command injection and path traversal using the tool abuse detection skill”
- “Probe this agent's web-fetch tool for SSRF via prompt injection and report any token leaks”
- “Run tool misuse tests against our customer support agent that has file read access and summarize the findings”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
tool-abuse-detection.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip tool-abuse-detection.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip tool-abuse-detection.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only run this against agents you own or are explicitly authorized to test, and in an isolated environment
- Let the skill stop after the first confirmed SSRF token hit, as instructed, to avoid unnecessary escalation
- Review each finding's conversation transcript yourself, since a response can look like output without being a real execution
What's inside
- SKILL.md
Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.