Show HN: ASL V6 – Open-source AST red-teaming engine for Python AI agents
ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases, combining Abstract Syntax Tree (AST) analysis with live Docker runtime testing to verify real security flaws. It achieves 98% false positive reduction through contextual filtering, is fully local and open-source under MIT license, and supports optional LLM-assisted patch generation via NVIDIA API.
Notifications You must be signed in to change notification settings
Fork 0
Star 1
BranchesTags
Open more actions menu
Folders and files
NameName
Last commit message
Last commit date
Latest commit
History
28 Commits
28 Commits
.gitignore
.gitignore
LICENSE
LICENSE
README.md
README.md
V6_ARCHITECTURE.md
V6_ARCHITECTURE.md
V6_ARCHITECTURE_V2.md
V6_ARCHITECTURE_V2.md
asl_v6_ci_cd_action.yml
asl_v6_ci_cd_action.yml
requirements.txt
requirements.txt
v6_advisory_engine.py
v6_advisory_engine.py
v6_ai_benchmarks.py
v6_ai_benchmarks.py
v6_ai_infra_security.py
v6_ai_infra_security.py
v6_dynamic_sandbox.py
v6_dynamic_sandbox.py
v6_specialist_agents.py
v6_specialist_agents.py
Repository files navigation
🔴 Currently accepting 3 advisory clients for Q3 2026. Email me or DM on LinkedIn.
Author: Siva Aditya Panuganti (Security Researcher)
Track Record: 6+ CVEs and GHSAs in production AI systems via responsible disclosure to BSI Germany, CERT-EE, and GitHub Security:
CVE-2026-22038 — AutoGPT secrets leak
GHSA-x58f-9m57-qc4m — FlowiseAI sandbox escape
CVE-2025-68621 — Trilium Notes timing side-channel
GHSA-p97p-7x96-7wj5 — LLaMmlein deserialization RCE
What It Does
ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases. It combines Abstract Syntax Tree (AST) code analysis with live Docker runtime testing to verify real security flaws without flooding developers with false alerts.
Technical Capabilities
10 Security Analyzers: Examines code for OWASP Top 10 LLM and Agent vulnerabilities, including prompt injection sinks, goal hijacking, unsafe code execution (eval/exec), and tool abuse.
AST Contextual Filtering: Parses Python syntax trees to ignore test suites, mock files, and docstrings. This eliminates around 98% of false positive alerts.
Live Docker Runtime Verification: Runs untrusted code snippets inside isolated ephemeral Docker containers (python:3.11-slim) to confirm whether an injection is exploitable in a live runtime environment.
Remediation Patch Generation (Optional): Generates structured code fixes and patch suggestions. Works offline using deterministic AST rules, or can connect to NVIDIA developer API endpoints if an API key is provided.
Why This Tool Is Free
ASL V6 is free and open-source under the MIT License.
100% Local Execution: The analyzers, AST filters, and Docker runtime tests execute locally on your machine. They do not send data over the internet or consume API tokens.
Bring Your Own Key (Optional): If you want LLM-assisted code patch suggestions, you can provide your own free developer API key via the NVIDIA_API_KEY environment variable. If no key is provided, the tool automatically uses offline rule-based patch suggestions at zero cost.
Verified Execution Benchmark
Tested on real filesystem repositories:
Repository Files Scanned Raw Alerts Validated True Positives False Positive Reduction Runtime Verification
LangGraph 513 606 13 97.9% VERIFIED IN RUNTIME
ASL V6 Engine 7 48 0 100.0% VERIFIED IN RUNTIME
Installation & Usage
- Install Dependencies
git clone https://github.com/sivaadityacoder/asl-v6.git cd asl-v6 pip install -r requirements.txt
- Run Live Security Audit
python3 v6_ai_infra_security.py /path/to/your/project
- Run the Benchmark
python3 v6_ai_benchmarks.py /path/to/repo1 /path/to/repo2
CI/CD Pull Request Gate
You can use the included GitHub Actions workflow (asl_v6_ci_cd_action.yml) to automatically check pull requests for security flaws during your CI/CD build process.
Security Research & Advisory Services
An automated test engine helps find known patterns, but securing custom agent architectures requires manual review. I work directly with engineering teams on a retainer or fixed-project basis:
Advisory Retainer ($2,500 / month): Monthly architecture review, manual vulnerability discovery, and remediation pull requests written directly for your codebase.
Emergency Security Assessment ($5,000 fixed): 1-week pre-launch code audit or post-incident review with proof-of-concept exploits and remediation guidance.
EU AI Act Technical Documentation ($3,500 - $5,000 fixed): Technical robustness testing and adversarial documentation for European compliance.
Contact: [email protected] | GitHub Profile
MIT license
Activity
Stars
1 star
Watchers
0 watching
Forks
0 forks
Report repository