Tencent’s Zhuque Lab built a security scanner that maps what AI services are running inside an organization and checks them against known vulnerabilities. AI-Infra-Guard fingerprints services like Ollama, vLLM and ComfyUI, then cross-references them against a database of more than 1,600 CVEs. It also inspects MCP servers and agent skills across 14 categories of risk, and runs jailbreak evaluations against a target model.
To assess whether a skill is malicious, the platform asks a language model to make a judgment call. Zhuque Lab scores that call against SkillTrustBench, a public benchmark containing 5,520 human-labeled samples across nine risk categories. False positive rates on that benchmark range from 1.20 percent to 18.67 percent, depending on which model does the judging. The model a team plugs in determines how much cleanup work follows. At the low end, roughly one clean skill in eighty gets flagged. At the high end, close to one flag in five turns out to be nothing.
Banks, carriers and manufacturers use the tool, including ICBC, China Merchants Bank, ChinaTelecom, Lenovo, vivo and Bilibili.
CVE Version-Matching Architecture
Zhuque Lab separates the scanner into two functional layers, and only one involves model-based interpretation. CVE version-matching operates independently of intent detection. “CVE version-matching isn’t intent-based at all,” the AI-Infra-Guard team said. “FPR there is purely a function of fingerprint accuracy.”
The scanner reads files an attacker controls. Both scanning components ingest tool descriptions and skill files from servers that may be hostile. Indirect prompt injection exploits this: instructions buried in content the model reads, aimed at the model doing the reading. Release 4.1.9 hardened the scanning agents against this attack vector. “File/tool content that gets read is placed into a dedicated, explicitly-delimited text block in the prompt, structurally separated from instructions, rather than mixed inline,” the team told Help Net Security. “The scanning agent is told to treat that block as data to analyze, never as commands to follow.” The approach reduces naive-to-moderate injection risk significantly, but the team is clear-eyed about its limits. “It’s a mitigation, not a formal guarantee,” and “we don’t claim it’s unbreakable, and we’d say that about any LLM-driven agent.” A clean scan result should be treated as one input, not a clearance.
Open-Source Security Considerations
The open-source build ships without authentication. The repository warns against exposing the platform on the internet, noting it “currently lacks an authentication mechanism.” A scanner meant to reveal which AI services are exposed becomes a tool holding API keys for every model it evaluates, reachable by anyone who can reach the port. “AI-Infra-Guard is a single-operator tool by design,” the team said. “No login, no RBAC.” Zhuque Lab’s recommended workaround places access control outside the application entirely: a reverse proxy in front of nginx with Basic Auth or an IP allowlist plus standard firewall rules. That layer handles authentication.
AI-Infra-Guard is available for free on GitHub.