Guide · Agent skill
How to use the Edgeone Skill Scanner agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Edgeone Skill Scanner is an agent skill: a folder with a SKILL.md file that teaches an AI coding agent how to do a specific job. In this case the job is checking other agent skills for security risks before you install or trust them. This guide explains what it makes the agent do, how to install it, how to trigger it with plain requests, and what to keep in mind about its limits.
Edgeone Skill ScannerTencent/AI-Infra-Guard · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Get the skill ZIP from this page and unzip it to a folder.
- 2Place the skill folder. Copy it into ~/.claude/skills/ for global use, or into a project's .claude/skills/ folder.
- 3Or upload in the Claude apps. Open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Check your agent's tools. Make sure the agent can read files and run shell commands so it can inspect the target skill.
- 5Ask for an audit. Use a request such as "Audit skill" followed by the path or name of the skill you want checked.
- 6Review the report card. Read the findings, open the cited files yourself, and decide whether to install the skill.
What is an agent skill and what does this one do?
An agent skill is a set of written instructions, usually a SKILL.md file plus optional scripts or config files, that an AI agent loads when a request matches it. The agent reads the instructions and follows them, using whatever file-reading and shell tools it has.
When you ask this skill to check whether a skill is safe, the agent reads the skill's files, looks for signs of malicious behaviour, excessive permissions, privacy access, high-risk operations and hardcoded secrets, and writes a report card for each skill. The skill is branded as Tencent Zhuque Lab's A.I.G (AI-Infra-Guard) scanner. Its instructions say the analysis is static: the agent reads files rather than running them.
Install the Edgeone Skill Scanner skill
Download the ZIP file from this page and unzip it. You can then place the skill folder in one of two locations:
Put it in ~/.claude/skills/ to make it available to Claude Code across your projects, or in a project's .claude/skills/ folder to limit it to that project.
Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.
- Global: ~/.claude/skills/
- Per project: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
Check what you need before you start
The skill is written for agent platforms that support SKILL.md skills. The source lists Claude Code, Cursor, Windsurf and CodeBuddy as examples, and also mentions OpenClaw and others.
The agent also needs file-reading tools and shell commands so it can inspect the skill files. Without them it cannot audit anything.
- An agent platform that supports SKILL.md skills (for example Claude Code, Cursor, Windsurf or CodeBuddy)
- File-reading tools and shell commands available to the agent
- The skill does not run scripts and does not use the network, according to its listing
Trigger the scanner with natural requests
You do not need a special command. Ask in plain language, and name the skill you want checked or its file location. The skill's description lists trigger phrases in English and Chinese, including the ones below.
Use it before installing a third-party skill, or when reviewing what is already installed. If you want to check every skill on a platform, you can ask whether your skills are safe and name the platform. The skill's instructions tell the agent to find skills using platform-specific locations, such as ~/.claude/skills/ and .claude/skills/ for Claude Code.
- "Audit skill ./path/to/skill-folder"
- "Scan skill my-skill-name"
- "Check skill safety for the skill I just downloaded"
- "Inspect skill ./downloads/some-skill"
- "Are my skills safe?" (checks the installed skills for the platform you name)
Read the report and act on it
For each skill, the agent outputs a separate report card, followed by a final summary when several skills are scanned. The audit only reports Medium-and-above findings that are reachable in real code paths. It also compares what the SKILL.md says the skill does with what the code actually does.
Treat a report as one input to your decision, not a verdict. Look at the specific finding the agent cites, open the file yourself, and decide whether the behaviour is justified for what the skill is meant to do. The skill itself distinguishes between a capability that is dangerous in principle and one used in a harmful or unjustified way.
- Compare declared purpose with actual behaviour
- Check any cited file yourself before deciding
- Remember that a clean report does not guarantee safety
Safety notes: scripts, network and file access
According to its listing, the skill runs no scripts and uses no network. Its security declaration says it performs static analysis by reading skill files only, and that no file contents, credentials or personal data are sent externally.
The scanning itself depends on the agent reading files on your device. Only scan skills whose contents you are comfortable having the agent read. The skill's own rules say the agent must never execute skill code during an audit.
- Runs scripts: no
- Uses network: no
- Reads files on your device, so only scan what you have authorised the agent to read
What people use it for
- Checking a third-party skill from the internet before adding it to your coding agent
- Reviewing which skills are installed on a team's coding agent or platform
- Comparing a skill's SKILL.md claims with what its scripts and config files actually do
- Getting a structured first-pass audit before a deeper manual security review
Frequently asked questions
Is the Edgeone Skill Scanner free?
The source lists the skill's licence as Apache-2.0 on the repository page, and the SKILL.md frontmatter lists MIT, so check the licence files in the download before you rely on either. The source does not mention pricing.
How do I install the edgeone skill scanner?
Download the ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for global use or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings, Capabilities, Skills.
Which agents does the skill work with?
The source says it works with any agent platform that supports SKILL.md skills, and gives Claude Code, Cursor, Windsurf and CodeBuddy as examples, plus OpenClaw and others.
Does the scanner send my skill files anywhere?
The skill's security declaration says it performs local static analysis and that no file contents, credentials or personal data are sent externally. Its listing also says it uses no network.
Can this skill guarantee a skill is safe?
No. The source says it is an LLM following written instructions, so it can miss issues and its report is only as reliable as the agent running it. Use it as a second opinion, not a guarantee.
Why did the scanner not run on my normal coding task?
Its description says it should not trigger for general agent usage, full system health checks, project debugging or normal development. It is meant only for checking agent skills.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you want a structured second opinion on a third-party agent skill before you install it, or a quick audit of what your installed skills actually do. Do not treat it as a complete safety guarantee, and pick a dedicated security review process if the stakes are high or you need certainty.
Download the skill