What are the best alternatives to aig-scanner?
The highest-scoring alternative to aig-scanner is codeql from trailofbits/skills, at 92/100 (grade A) on the Suede Skill Check; aig-scanner scores 82/100. The table compares 8 security audit skills in security from other publishers, each with a full SuedeAI.directory page. Every score follows the published rubric.
aig-scanner and 8 alternatives
Alternatives share aig-scanner's category and task, come from other publishers and each have a full directory page. Ranked by Suede Skill Check score.
| Skill | Publisher | Suede Skill Check | License | What it does |
|---|---|---|---|---|
| aig-scanner Compared skill | Tencent Tencent/AI-Infra-Guard | 82/100 · B | MIT | Runs AI security scans of infrastructure, AI tools and skills, and AI agents, and evaluates LLM jailbreak resistance with Tencent's AI-Infra-Guard. |
| codeql | Trail of Bits Official trailofbits/skills | 92/100 · A | CC-BY-SA-4.0 | Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with run-all and important-only scan modes. |
| semgrep | Trail of Bits Official trailofbits/skills | 92/100 · A | CC-BY-SA-4.0 | Runs a Semgrep security scan over a codebase, detecting languages, selecting rulesets, requiring approval of the plan, and merging output to SARIF. |
| agentic-actions-auditor | Trail of Bits Official trailofbits/skills | 89/100 · B | CC-BY-SA-4.0 | Audits GitHub Actions workflows for security vulnerabilities where attacker-controlled input reaches AI agents like Claude Code Action, Gemini CLI, or Codex in CI/CD. |
| skill-scanner | Sentry Official getsentry/skills | 88/100 · B | Apache-2.0 | Scans agent skills for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks before installation. |
| gha-security-review | Sentry Official getsentry/skills | 86/100 · B | Apache-2.0 | Reviews GitHub Actions workflows for exploitation vulnerabilities such as pwn requests, expression injection, credential theft, and supply chain attacks, with concrete proof-of-concept scenarios. |
| firebase-security-rules-auditor | Firebase Official firebase/skills | 78/100 · C | Apache-2.0 | Audits Firebase Firestore and Cloud Storage security rules for vulnerabilities including privilege escalation, role bypasses, and resource exhaustion. |
| redis-security | Redis Official redis/agent-skills | 75/100 · C | MIT | Guides Redis security, covering authentication with requirepass and ACL users, TLS, least-privilege access control, network exposure limits, and disabling dangerous commands. |
| security-audit | Cloudflare Official cloudflare/security-audit-skill | 72/100 · C | MIT | Provides security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons, including focused reviews, vulnerability research, audits, and pen tests. |
Questions and answers
What is the highest-scoring alternative to aig-scanner?
codeql from trailofbits/skills, at 92/100, grade A. It earns full points for structural checks, recent maintenance and curated-list citations. Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis, with run-all and important-only scan modes.
How does aig-scanner compare with its alternatives?
aig-scanner scores 82/100, grade B. Of the 8 alternatives, 5 score higher and 3 score lower; their scores run from 72 to 92. All of them sit in security and match the security audits keyword map.
Are the alternatives to aig-scanner free?
All 8 alternatives to aig-scanner are published in public GitHub repositories and cost nothing to download. Every one uses an open-source or open-content license, led by Apache-2.0 (3), CC-BY-SA-4.0 (3) and MIT (2), so you can use and adapt the files at no cost under those terms.
Do the alternatives to aig-scanner work in Claude Code, Codex and Cursor?
Yes. Each of the 8 alternatives to aig-scanner is a SKILL.md folder in the Agent Skills format, which Claude Code, Codex and Cursor all read. The skills CLI (npx skills add) installs every one of them into Claude Code, Codex, Cursor and other agents, and each full skill page adds a project-level copy into .claude/skills for Claude Code and .agents/skills for Codex.