Show HN: ASL V6 – Open-source AST red-teaming engine for Python AI agents

sivaaditya1 pts0 comments

GitHub - sivaadityacoder/asl-v6: Open-source AI vulnerability assessment and red-teaming engine using AST analysis and Docker runtime verification. · GitHub

/" data-turbo-transient="true" />

Skip to content

Search or jump to...

Search code, repositories, users, issues, pull requests...

-->

Search

Clear

Search syntax tips

Provide feedback

--><br>We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Cancel

Submit feedback

Saved searches

Use saved searches to filter your results more quickly

-->

Name

Query

To see all available qualifiers, see our documentation.

Cancel

Create saved search

Sign in

/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up

Appearance settings

Resetting focus

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

sivaadityacoder

asl-v6

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>27 Commits<br>27 Commits

.gitignore

.gitignore

LICENSE

LICENSE

README.md

README.md

V6_ARCHITECTURE.md

V6_ARCHITECTURE.md

V6_ARCHITECTURE_V2.md

V6_ARCHITECTURE_V2.md

asl_v6_ci_cd_action.yml

asl_v6_ci_cd_action.yml

requirements.txt

requirements.txt

v6_advisory_engine.py

v6_advisory_engine.py

v6_ai_benchmarks.py

v6_ai_benchmarks.py

v6_ai_infra_security.py

v6_ai_infra_security.py

v6_dynamic_sandbox.py

v6_dynamic_sandbox.py

v6_specialist_agents.py

v6_specialist_agents.py

View all files

Repository files navigation

ASL V6 — Open-Source AI Red-Teaming & Exploit Verification Engine

🔴 Currently accepting 3 advisory clients for Q3 2026. Email me or DM on LinkedIn.

Author: Siva Aditya Panuganti (Security Researcher)

Track Record: 6+ CVEs and GHSAs in production AI systems via responsible disclosure to BSI Germany, CERT-EE, and GitHub Security:

CVE-2026-22038 — AutoGPT secrets leak

GHSA-x58f-9m57-qc4m — FlowiseAI sandbox escape

CVE-2025-68621 — Trilium Notes timing side-channel

GHSA-p97p-7x96-7wj5 — LLaMmlein deserialization RCE

What It Does

ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases. It combines Abstract Syntax Tree (AST) code analysis with live Docker runtime testing to verify real security flaws without flooding developers with false alerts.

Technical Capabilities

10 Security Analyzers: Examines code for OWASP Top 10 LLM and Agent vulnerabilities, including prompt injection sinks, goal hijacking, unsafe code execution (eval/exec), and tool abuse.

AST Contextual Filtering: Parses Python syntax trees to ignore test suites, mock files, and docstrings. This eliminates around 98% of false positive alerts.

Live Docker Runtime Verification: Runs untrusted code snippets inside isolated ephemeral Docker containers (python:3.11-slim) to confirm whether an injection is exploitable in a live runtime environment.

Remediation Patch Generation (Optional): Generates structured code fixes and patch suggestions. Works offline using deterministic AST rules, or can connect to NVIDIA developer API endpoints if an API key is provided.

Why This Tool Is Free

ASL V6 is free and open-source under the MIT License.

100% Local Execution: The analyzers, AST filters, and Docker runtime tests execute locally on your machine. They do not send data over the internet or consume API tokens.

Bring Your Own Key (Optional): If you want LLM-assisted code patch suggestions, you can provide your own free developer API key via the NVIDIA_API_KEY environment variable. If no key is provided, the tool automatically uses offline rule-based patch suggestions at zero cost.

Verified Execution Benchmark

Tested on real filesystem repositories:

Repository<br>Files Scanned<br>Raw Alerts<br>Validated True Positives<br>False Positive Reduction<br>Runtime Verification

LangGraph<br>513<br>606<br>13<br>97.9%<br>VERIFIED IN RUNTIME

ASL V6 Engine<br>48<br>100.0%<br>VERIFIED IN RUNTIME

Installation & Usage

1. Install Dependencies

git clone https://github.com/sivaadityacoder/asl-v6.git<br>cd asl-v6<br>pip install -r requirements.txt

2. Run Live Security Audit

python3 v6_ai_infra_security.py /path/to/your/project

3. Run the Benchmark

python3 v6_ai_benchmarks.py /path/to/repo1 /path/to/repo2

CI/CD Pull Request Gate

You can use the included GitHub Actions workflow (asl_v6_ci_cd_action.yml) to automatically check pull requests for security flaws during your CI/CD build process.

Security Research & Advisory Services

An automated test engine helps find known patterns, but securing custom agent architectures requires manual review. I work directly with engineering teams on a retainer or fixed-project basis:

Advisory Retainer ($2,500 /...

runtime code security engine github docker

Related Articles