edgeone-skill-scanner

Name: edgeone-skill-scanner
Author: Tencent

4.2kstars399forks

How to install edgeone-skill-scanner?

tencent/ai-infra-guard/edgeone-skill-scanner

$npx -y skills add Tencent/AI-Infra-Guard --skill edgeone-skill-scanner

Installs into the current project.

Summary

Scan any agent skill for security risks before you install or use it. Powered by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). 100% local static analysis — no file contents or credentials leave your device. Compatible with CodeBuddy, Cursor, Windsurf, Claude Code, OpenClaw and more.

Files · 1

View on GitHub

SKILL.md

1	# Tencent Zhuque Skill Scanner
2
3	Agent Skills security scanner powered by Tencent Zhuque Lab A.I.G.
4	Compatible with any agent platform that supports skills (e.g. OpenClaw, Qclaw, WorkBuddy, CodeBuddy, Cursor, Windsurf, Claude Code, etc.).
5
6	## Security Declaration
7
8	Local-only analysis: this scanner performs static analysis by reading skill files only.
9	No file contents, credentials, or personal data are sent externally.
10
11	---
12
13	## Language Detection Rule — EXECUTE BEFORE ANYTHING ELSE
14
15	Detect the language of the user's triggering message and lock the output language for the entire run.
16	This detection is an internal step only — do NOT output any text that reveals the detection
17	result, such as "当前输出语言为中文", "Detected language: English", or similar meta-statements.
18	Simply use the detected language silently for all subsequent output.
19
20	\| User message language \| Output language \|
21	\|-----------------------\|-----------------\|
22	\| Chinese \| Chinese — entire output in Chinese \|
23	\| English \| English — entire output in English \|
24	\| Other language \| Match that language \|
25	\| Cannot determine \| Default to Chinese \|
26
27	All output — scan start prompt, table headers, labels, prose, verdict, and footer — must be written
28	exclusively in the detected language. Do NOT mix languages or announce the language choice at any point.
29
30	---
31
32	## Scan Start Prompt
33
34	Before starting the scan, output the following line with `{skill}` replaced by the actual skill name.
35	Translate it to match the detected output language.
36
37	`🔍 腾讯朱雀实验室 A.I.G Skill Scanner 正在检测 {skill} 的安全性，请稍候...`
38
39	---
40
41	## Scan Workflow
42
43	Determine which mode to use based on the user's request:
44
45	\| User intent \| Mode \|
46	\|-------------\|------\|
47	\| Scan all skills on a platform, or asks "are my skills safe?" without specifying a file \| Mode A — Full-platform scan \|
48	\| Scan a specific skill file or a named skill \| Mode B — Single-skill audit \|
49
50	---
51
52	### Mode A — Full-platform scan
53
54	Use this mode when the user wants to check the security of all skills on a given agent platform.
55
56	#### A-1. Identify the platform
57
58	Determine which agent platform the user is referring to. Common platforms include but are not
59	limited to: OpenClaw, Cursor, Windsurf, CodeBuddy, WorkBuddy, Claude Code, qclaw, etc.
60
61	How to determine:
62	- If the user explicitly names a platform, use that.
63	- If the user says "scan my skills" or "check all skills" without naming a platform, infer the
64	platform from the current runtime environment (e.g. if running inside CodeBuddy, the platform
65	is CodeBuddy).
66	- If the platform still cannot be determined, ask the user to clarify.
67
68	#### A-2. Discover skills
69
70	Once the platform is identified, use the platform-specific method below to enumerate all installed
71	skills. Do NOT output a list of all discovered skill names and paths before scanning — proceed
72	directly to auditing each skill one by one.
73
74	CRITICAL — No skill may be skipped: Both user-installed skills and system/platform built-in
75	skills must be included. If a platform ships pre-installed or bundled skills, they must be
76	discovered and audited with the same rules as user-installed ones.
77
78	Platform-specific skill discovery methods:
79
80	\| Platform \| Discovery method \|
81	\|----------\|-----------------\|
82	\| OpenClaw \| Ask the Agent: "你的 skill 有哪些" or "list your skills" to get the full skill list \|
83	\| CodeBuddy \| Scan both the system directory `~/.codebuddy/plugins/marketplaces/` and the user directory `~/.codebuddy/plugins/` for all skill files and subdirectories. Also check if the platform exposes a built-in skill list via its tools (e.g. `use_skill` tool's `<available_skills>` section) and include those. \|
84	\| Cursor \| Scan the local directory `~/.cursor/extensions/` and project-level `.cursor/skills/` for skill definitions \|
85	\| Windsurf \| Scan the local directory `~/.windsurf/skills/` and p

People who liked this also viewed

6 picks

Type

edgeone-skill-scanner

4.2kstars399forks

View on GitHub

How to install edgeone-skill-scanner?

tencent/ai-infra-guard/edgeone-skill-scanner

$npx -y skills add Tencent/AI-Infra-Guard --skill edgeone-skill-scanner

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Tencent Zhuque Skill Scanner
2
3	Agent Skills security scanner powered by Tencent Zhuque Lab A.I.G.
4	Compatible with any agent platform that supports skills (e.g. OpenClaw, Qclaw, WorkBuddy, CodeBuddy, Cursor, Windsurf, Claude Code, etc.).
5
6	## Security Declaration
7
8	Local-only analysis: this scanner performs static analysis by reading skill files only.
9	No file contents, credentials, or personal data are sent externally.
10
11	---
12
13	## Language Detection Rule — EXECUTE BEFORE ANYTHING ELSE
14
15	Detect the language of the user's triggering message and lock the output language for the entire run.
16	This detection is an internal step only — do NOT output any text that reveals the detection
17	result, such as "当前输出语言为中文", "Detected language: English", or similar meta-statements.
18	Simply use the detected language silently for all subsequent output.
19
20	\| User message language \| Output language \|
21	\|-----------------------\|-----------------\|
22	\| Chinese \| Chinese — entire output in Chinese \|
23	\| English \| English — entire output in English \|
24	\| Other language \| Match that language \|
25	\| Cannot determine \| Default to Chinese \|
26
27	All output — scan start prompt, table headers, labels, prose, verdict, and footer — must be written
28	exclusively in the detected language. Do NOT mix languages or announce the language choice at any point.
29
30	---
31
32	## Scan Start Prompt
33
34	Before starting the scan, output the following line with `{skill}` replaced by the actual skill name.
35	Translate it to match the detected output language.
36
37	`🔍 腾讯朱雀实验室 A.I.G Skill Scanner 正在检测 {skill} 的安全性，请稍候...`
38
39	---
40
41	## Scan Workflow
42
43	Determine which mode to use based on the user's request:
44
45	\| User intent \| Mode \|
46	\|-------------\|------\|
47	\| Scan all skills on a platform, or asks "are my skills safe?" without specifying a file \| Mode A — Full-platform scan \|
48	\| Scan a specific skill file or a named skill \| Mode B — Single-skill audit \|
49
50	---
51
52	### Mode A — Full-platform scan
53
54	Use this mode when the user wants to check the security of all skills on a given agent platform.
55
56	#### A-1. Identify the platform
57
58	Determine which agent platform the user is referring to. Common platforms include but are not
59	limited to: OpenClaw, Cursor, Windsurf, CodeBuddy, WorkBuddy, Claude Code, qclaw, etc.
60
61	How to determine:
62	- If the user explicitly names a platform, use that.
63	- If the user says "scan my skills" or "check all skills" without naming a platform, infer the
64	platform from the current runtime environment (e.g. if running inside CodeBuddy, the platform
65	is CodeBuddy).
66	- If the platform still cannot be determined, ask the user to clarify.
67
68	#### A-2. Discover skills
69
70	Once the platform is identified, use the platform-specific method below to enumerate all installed
71	skills. Do NOT output a list of all discovered skill names and paths before scanning — proceed
72	directly to auditing each skill one by one.
73
74	CRITICAL — No skill may be skipped: Both user-installed skills and system/platform built-in
75	skills must be included. If a platform ships pre-installed or bundled skills, they must be
76	discovered and audited with the same rules as user-installed ones.
77
78	Platform-specific skill discovery methods:
79
80	\| Platform \| Discovery method \|
81	\|----------\|-----------------\|
82	\| OpenClaw \| Ask the Agent: "你的 skill 有哪些" or "list your skills" to get the full skill list \|
83	\| CodeBuddy \| Scan both the system directory `~/.codebuddy/plugins/marketplaces/` and the user directory `~/.codebuddy/plugins/` for all skill files and subdirectories. Also check if the platform exposes a built-in skill list via its tools (e.g. `use_skill` tool's `<available_skills>` section) and include those. \|
84	\| Cursor \| Scan the local directory `~/.cursor/extensions/` and project-level `.cursor/skills/` for skill definitions \|
85	\| Windsurf \| Scan the local directory `~/.windsurf/skills/` and p

People who liked this also viewed

6 picks

Type