Is the AI/ML Attack Surface skill free?

Yes. The skill itself is free from allsmog/vuln-scout. SkillProof publishes the install command and an independent test verdict at no cost.

What is the AI/ML Attack Surface SkillProof Score?

8.4/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 4/5.

How do I install AI/ML Attack Surface?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use AI/ML Attack Surface with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

AI/ML Attack Surface

Grep-driven checklist for ML deserialization, prompt injection, and untrusted model loading

by allsmog · allsmog/vuln-scout

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 8.4/10
Tested: Jul 14, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 8dfafbc

Fed it a 29-line file with torch.load, pickle.load, np.load(allow_pickle=True) and an f-string prompt-injection pattern; its own grep battery, run for real, caught all 4 real issues (the dedicated prompt-injection regex actually missed the case and it only surfaced via the generic messages/system grep — a real gap in its own suggested command) and mapped each hit to a CWE plus a concrete safe alternative (weights_only=True, skops.io, safetensors).

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 7/10
Docs & honesty 4/5

What AI/ML Attack Surface does

A single-file security reference that catalogs AI/ML-specific vulnerability classes (unsafe torch/pickle/numpy deserialization, prompt injection, Jupyter notebook injection, untrusted HuggingFace model loading, training-data poisoning) with CWE mappings, ready-to-run grep detection commands, and safe alternatives per framework. Triggers on AI security, ML pipeline attack, prompt injection, or unsafe model loading requests.

How to install AI/ML Attack Surface

git clone https://github.com/allsmog/vuln-scout
cd vuln-scout
mkdir -p ~/.claude/skills
cp -r vuln-scout/skills/ai-ml-attacks ~/.claude/skills/ai-ml-attack-surface

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger AI/ML Attack Surface

/ai-ml-attack-surface Grep-driven checklist for ML deserialization, prompt injection, and untrusted model loading

It also activates on plain-language prompts like these:

Audit this ML codebase for unsafe model deserialization
Check our inference service for prompt-injection exposure
Scan this repo for untrusted pickle and model-loading risks

Frequently asked questions

Is the AI/ML Attack Surface skill free?: Yes. The skill itself is free from allsmog/vuln-scout. SkillProof publishes the install command and an independent test verdict at no cost.
Does AI/ML Attack Surface work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Tested · Works. Fed it a 29-line file with torch.load, pickle.load, np.load(allow_pickle=True) and an f-string prompt-injection pattern; its own grep battery, run for real, caught all 4 real issues (the dedicated prompt-injection regex actually missed the case and it only surfaced via the generic messages/system grep — a real gap in its own suggested command) and mapped each hit to a CWE plus a concrete safe alternative (weights_only=True, skops.io, safetensors).
What is the AI/ML Attack Surface SkillProof Score?: 8.4/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 7/10, docs & honesty 4/5.
How do I install AI/ML Attack Surface?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use AI/ML Attack Surface with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.