Tencent’s Zhuque Lab built AI-Infra-Guard, an open-source security scanner for AI systems. It fingerprints running services such as Ollama, vLLM and ComfyUI and checks them against more than 1,600 known CVEs, inspects MCP servers and agent skills across 14 categories of risk, and runs jailbreak evaluations against a target model.
To check a skill, the platform asks a language model whether it looks malicious. Zhuque Lab scores that call against SkillTrustBench, a public set of 5,520 human-labeled samples across nine risk categories. False positive rates there run from 1.20 percent to 18.67 percent, depending on which model does the judging.
The model a team plugs in decides how much reading they end up doing. At the low end, about one clean skill in eighty gets flagged. At the high end, close to one flag in five is a waste of somebody’s afternoon. Banks, carriers and manufacturers use the tool, including ICBC, China Merchants Bank, China Telecom, Lenovo, vivo and Bilibili.
Zhuque Lab splits the platform into two layers, and only one of them involves interpretation. “CVE version-matching isn’t intent-based at all,” the AI-Infra-Guard team said. “FPR there is purely a function of fingerprint accuracy.”
The scanner reads files an attacker wrote
Both scanning components ingest tool descriptions and skill files that a hostile server controls. Indirect prompt injection is the technique that exploits this: instructions buried in content the model reads, aimed at the model doing the reading. Release 4.1.9 hardened the scanning agents against it.
“File/tool content that gets read is placed into a dedicated, explicitly-delimited text block in the prompt, structurally separated from instructions, rather than mixed inline. The scanning agent is told to treat that block as data to analyze, never as commands to follow,” the team told Help Net Security.
The move “cuts naive-to-moderate injection significantly,” but “it’s a mitigation, not a formal guarantee,” and “we don’t claim it’s unbreakable, and we’d say that about any LLM-driven agent.” A defender scanning a suspicious MCP server should treat a clean result as one input, not a clearance.
No login in the open-source build
The repository carries a warning against putting the platform on the internet: it “currently lacks an authentication mechanism.” A scanner built to tell an organization which of its AI services are exposed comes with instructions not to expose the scanner.
“AI-Infra-Guard is a single-operator tool by design,” the team said. “No login, no RBAC.”
Zhuque Lab’s answer is to put the access control outside the application: “the documented recommendation is a reverse proxy in front (nginx with Basic Auth or an IP allowlist) plus normal firewall rules.” That is the login layer. A team that skips it is running a vulnerability scanner that holds the API keys for every model it evaluates, reachable by anyone who can route to the port.
AI-Infra-Guard is available for free on GitHub.
Must read:
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!
