GitHub - sivaadityacoder/asl-v6: Open-source AI vulnerability assessment and red-teaming engine using AST analysis and Docker runtime verification. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
sivaadityacoder
asl-v6
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>27 Commits<br>27 Commits
.gitignore
.gitignore
LICENSE
LICENSE
README.md
README.md
V6_ARCHITECTURE.md
V6_ARCHITECTURE.md
V6_ARCHITECTURE_V2.md
V6_ARCHITECTURE_V2.md
asl_v6_ci_cd_action.yml
asl_v6_ci_cd_action.yml
requirements.txt
requirements.txt
v6_advisory_engine.py
v6_advisory_engine.py
v6_ai_benchmarks.py
v6_ai_benchmarks.py
v6_ai_infra_security.py
v6_ai_infra_security.py
v6_dynamic_sandbox.py
v6_dynamic_sandbox.py
v6_specialist_agents.py
v6_specialist_agents.py
View all files
Repository files navigation
ASL V6 — Open-Source AI Red-Teaming & Exploit Verification Engine
🔴 Currently accepting 3 advisory clients for Q3 2026. Email me or DM on LinkedIn.
Author: Siva Aditya Panuganti (Security Researcher)
Track Record: 6+ CVEs and GHSAs in production AI systems via responsible disclosure to BSI Germany, CERT-EE, and GitHub Security:
CVE-2026-22038 — AutoGPT secrets leak
GHSA-x58f-9m57-qc4m — FlowiseAI sandbox escape
CVE-2025-68621 — Trilium Notes timing side-channel
GHSA-p97p-7x96-7wj5 — LLaMmlein deserialization RCE
What It Does
ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases. It combines Abstract Syntax Tree (AST) code analysis with live Docker runtime testing to verify real security flaws without flooding developers with false alerts.
Technical Capabilities
10 Security Analyzers: Examines code for OWASP Top 10 LLM and Agent vulnerabilities, including prompt injection sinks, goal hijacking, unsafe code execution (eval/exec), and tool abuse.
AST Contextual Filtering: Parses Python syntax trees to ignore test suites, mock files, and docstrings. This eliminates around 98% of false positive alerts.
Live Docker Runtime Verification: Runs untrusted code snippets inside isolated ephemeral Docker containers (python:3.11-slim) to confirm whether an injection is exploitable in a live runtime environment.
Remediation Patch Generation (Optional): Generates structured code fixes and patch suggestions. Works offline using deterministic AST rules, or can connect to NVIDIA developer API endpoints if an API key is provided.
Why This Tool Is Free
ASL V6 is free and open-source under the MIT License.
100% Local Execution: The analyzers, AST filters, and Docker runtime tests execute locally on your machine. They do not send data over the internet or consume API tokens.
Bring Your Own Key (Optional): If you want LLM-assisted code patch suggestions, you can provide your own free developer API key via the NVIDIA_API_KEY environment variable. If no key is provided, the tool automatically uses offline rule-based patch suggestions at zero cost.
Verified Execution Benchmark
Tested on real filesystem repositories:
Repository<br>Files Scanned<br>Raw Alerts<br>Validated True Positives<br>False Positive Reduction<br>Runtime Verification
LangGraph<br>513<br>606<br>13<br>97.9%<br>VERIFIED IN RUNTIME
ASL V6 Engine<br>48<br>100.0%<br>VERIFIED IN RUNTIME
Installation & Usage
1. Install Dependencies
git clone https://github.com/sivaadityacoder/asl-v6.git<br>cd asl-v6<br>pip install -r requirements.txt
2. Run Live Security Audit
python3 v6_ai_infra_security.py /path/to/your/project
3. Run the Benchmark
python3 v6_ai_benchmarks.py /path/to/repo1 /path/to/repo2
CI/CD Pull Request Gate
You can use the included GitHub Actions workflow (asl_v6_ci_cd_action.yml) to automatically check pull requests for security flaws during your CI/CD build process.
Security Research & Advisory Services
An automated test engine helps find known patterns, but securing custom agent architectures requires manual review. I work directly with engineering teams on a retainer or fixed-project basis:
Advisory Retainer ($2,500 /...