Agent skill · security · borghei
ai-security
This skill should be used when the user asks to "scan AI systems for security threats", "check for prompt injection vulnerabilities", "assess model security posture", "detect data poisoning risks", or "audit AI/ML pipeline security".
Why this skill is useful
Adds an executable script for scanning AI systems for specific security vulnerabilities that the AI wouldn't generate on its own.
What it needs
Requires python installed locally. About 2k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
AI Security Category: Engineering Domain: AI/ML Security Overview The AI Security skill provides specialized threat scanning for AI and machine learning systems. It identifies vulnerabilities unique to AI workloads including prompt injection, data poisoning, model extraction, adversarial inputs, and insecure model serving configurations. Clarify First Before running the scan, confirm these inputs. If any is unknown or vague, ASK — do not assume: [ ] Scan target & path — which codebase or directory to analyze (sets --path and what gets scanned) [ ] Threat categories — all, or specific (prompt-injection, data-poisoning, model-extraction, adversarial-input, insecure-serving) (sets --category) [ ] Severity threshold & context — full audit vs pre-deployment gate (sets --min-severity and whether zero high/critical findings is a hard gate) Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the artifact. Quick Start Tools Overview Tool Purpose Key Flags ------ --------- ----------- aithreatscanner.py Scan code for AI-specific security threats --path, --category, --min-severity, --format aithreatscanner.py Performs static analysis of source code to detect AI security anti-patterns and vulnerabilities: Prompt Injection: Detects unsanitized user input concatenated into prompts, missing input validation, template injection vectors Data Poisoning: Identifies unvalidated training data pipelines, missing data integrity checks, insecure data loading Model Extraction: Finds exposed model endpoints without rate limiting, missing authentication on inference APIs, verbose error responses leaking model details Adversarial Input: Detects missing input validation on model inputs, lack of input bounds checking, no anomaly detection on inference requests Insecure Model Serving: Identifies models loaded from untrusted sources, pickle deserialization risks, missing model signature verification Workflows Fu …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/ai-security