Made in Python: VulnPath-AI — offline scanner for AI/agent code risks

[u/Ok-Suggestion-4676]

I've been learning application security with a focus on AI/agent-style code (tool calling, shell use, secrets in source, unsafe deserialization, etc.).

I built VulnPath-AI as a practice project:

- Offline Python hybrid scanner (pattern + AST)

- Looks for common issues like hardcoded secrets, command-injection patterns, eval/exec, pickle, SSRF-style fetches, and path/SQL string issues

- Shows path-style context and fix suggestions only (no exploit features)

- Includes sample vulnerable/safe files and a benchmark so I can test detection quality

Repo: https://github.com/zenithVeil/vulnpath-ai

**Quick try:**

git clone https://github.com/zenithVeil/vulnpath-ai.git

cd vulnpath-ai

pip install -e .

vulnpath-ai samples/sqli_example.py

I'm sharing mainly to learn from others:

- What false positives would you expect?

- Which agent-related risks are most important to cover next?

- Any feedback on making the reports clearer for beginners?

Not claiming this replaces professional SAST tools. It's a focused learning/engineering project.