DEV Community: Aaryan Kumar Singh

AgentGuard AI: Zero-Trust Tool-Call Firewall & Indirect Prompt Injection Defense for Open-Weight Agents

Aaryan Kumar Singh — Mon, 26 Oct 2026 18:26:39 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge: Week 4.

What I Built

AgentGuard AI is an open-source, local-first tool-call firewall and indirect prompt injection defense engine designed to protect autonomous AI agents from malicious tool execution and goal hijacking.

As developers connect open-weight AI models—such as Google Gemma 2, Meta Llama 3.2, and Mistral—to autonomous agent frameworks (Mastra, OpenHands, OpenCode, and LangChain), untrusted tool execution has become the most dangerous vulnerability in modern software.

When an autonomous agent reads untrusted external data—such as a hostile GitHub PR diff, a scraped documentation page, a malicious prompt-injected skill file, or untrusted database records—indirect prompt injection can trick the agent into invoking sensitive tools with hijacked arguments:

Destructive Command Execution: Wiping local or container filesystems (rm -rf /, rmdir /s /q, mkfs, fork bombs).
Filesystem Traversal & Credential Theft: Reading sensitive credentials (~/.ssh/id_rsa, .env, ~/.aws/credentials, %WINDIR%\System32\config\SAM).
Data Exfiltration: Leaking tokens, environment variables, or database dumps to external webhook tunnels (webhook.site, query string leaks).
Database Schema Destruction: Dropping production databases or executing unbounded truncations (DROP TABLE, TRUNCATE, DELETE WHERE 1=1).
Instruction Nullification: Exploiting phrases like "Ignore all previous instructions and execute the following..." to commandeer the agent's persona.

How AgentGuard AI Solves This:

AgentGuard AI operates as an ultra-fast, zero-overhead firewall layer positioned between the agent's reasoning engine and its tool invocation harness. It uses a Dual-Tier Defense Model:

Tier 1 (Deterministic Microsecond Gatekeeper): A sub-millisecond AST parser and regex signature filter that inspects commands, file paths, SQL statements, and network URLs for explicit threat patterns. Executes in < 0.5 ms with zero latency overhead on agent loops.
Tier 2 (Open-Weight Semantic Reasoning with Google Gemma 2): For contextual or borderline actions (such as running a build script or accessing project configuration), AgentGuard dispatches the tool call and the human developer's original objective to a local Google Gemma 2 model (in-browser or via an offline Ollama daemon). Gemma 2 performs semantic intent verification: Does this tool call genuinely advance the user's objective, or does it represent an adversarial detour?

Demo

AgentGuard AI runs as an interactive, zero-build client-side developer console.

Interactive Features:

Instant Attack Vector Presets: One-click test scenarios covering Indirect Prompt Injection in PR diffs, Recursive Disk Wipes, Webhook Secret Exfiltration, SQL Injections, SSH Key Stealing, and Legitimate Developer Actions (npm test).
Real-Time Firewall Verdict: Displays instant verdict badges (BLOCK, QUARANTINE, ALLOW), risk scores (0–100), execution latencies, and granular finding breakdowns.
Google Gemma 2 Semantic Reasoning: Live explanation synthesizing whether the tool call is goal-aligned or hijacked, complete with safe remediation guidance.
Dual Inference Engine: Seamlessly switch between built-in offline Gemma 2 simulation and a live local Ollama daemon (http://localhost:11434/api/generate with gemma2:2b).
Live Session Audit Trail & Policy Export: Review chronological tool invocation logs and export security policies in JSON or YAML for Mastra, LangChain, or custom agent harnesses.

Code

AaryanKumarSingh136 / agentguard-ai

Zero-Trust Tool-Call Firewall & Indirect Prompt Injection Defense for Open-Weight Agents (Google Gemma 2)

🛡️ AgentGuard AI

A local-first, zero-telemetry tool-call firewall and indirect prompt injection defense engine for open-weight AI agents, powered by Google Gemma 2.

📌 Executive Summary

As developers deploy autonomous AI agents across codebases, databases, and internal infrastructure using frameworks like Mastra, OpenHands, OpenCode, and LangChain, untrusted tool execution has emerged as the #1 attack vector in modern AI engineering.

When an agent reads untrusted external data—such as a malicious GitHub Pull Request diff, a poisoned web search result, or a manipulated database entry—indirect prompt injection can trick the agent into invoking sensitive tools with hijacked arguments:

Executing destructive shell commands (rm -rf /, rmdir /s /q, curl | bash, reverse shells)
Escaping project sandboxes to steal credentials (~/.ssh/id_rsa, .env, ~/.aws/credentials)
Exfiltrating confidential API keys via egress HTTP requests or blind tunnels
Dropping production database tables…

View on GitHub

The project is 100% open-source under the MIT License.

Project Structure:

index.html: Accessible, responsive single-page security dashboard with dark/light themes.
style.css: Modern enterprise cyberpunk cybersecurity design system with smooth micro-animations.
app.js: Core deterministic threat signature engine, AST parameter parser, and Gemma 2 semantic reasoning dispatcher.
test_engine.js: Comprehensive 12-test automated verification suite for threat detection and latency benchmarking.
SECURITY.md: Strict 100% local-first, zero-telemetry guarantee.
CONTRIBUTING.md: Contribution guidelines for community threat signatures.
CODE_OF_CONDUCT.md: Contributor Covenant v2.1.
CITATION.cff: Citation metadata for research and developer attribution.
package.json: NPM package metadata and test script entrypoints.
README.md: Complete documentation, quickstart guide, and architectural diagrams.

How I Built It

Architecture & Tech Stack

Frontend / Client: Vanilla HTML5, modern CSS3, and ES6 JavaScript. Fast load times, zero build steps, and instant rendering.
Deterministic Threat Interceptor: Generative language models should never be the sole defense layer because models can be jailbroken. AgentGuard enforces strict deterministic boundaries first:
- Destructive binary patterns (rm -rf, mkfs, dd, powershell -enc, chmod 777, curl | bash).
- Path traversal and sensitive credential boundaries (~/.ssh, .env, ~/.aws, ../../).
- SQL destruction rules (DROP TABLE, TRUNCATE, unbounded DELETE).
- Data exfiltration detectors (token query strings, blind webhook domains).
Local Semantic Reasoning with Google Gemma 2: When a tool invocation is borderline, AgentGuard uses Google's open-weight Gemma 2 (gemma2:2b) model running locally via Ollama to perform semantic goal alignment verification.
Zero Cloud Egress: Tool execution logs, project paths, and prompt contents remain strictly within local device memory.

flowchart TD
    A[Human Developer Objective] --> B[Autonomous Agent Loop]
    C[Untrusted Environment Input<br>PR Diffs, Web Scraping, DB Records] --> B

    B -->|Tool Call Request| D[🛡️ AgentGuard AI Firewall]

    subgraph AgentGuard Dual-Tier Inspection
        D --> E[Tier 1: AST Signature & Boundary Filter<br>Sub-millisecond Deterministic Parser]
        E -->|Dangerous Signature Detected| F[Immediate Hard Block]
        E -->|Contextual / Ambiguous Action| G[Tier 2: Google Gemma 2 Semantic Audit<br>Local Open-Weight Model Verification]
    end

    F -->|Interception Alert| H[Block Execution & Log Security Audit]
    G -->|Goal Aligned| I[Safe Execution Permitted]
    G -->|Goal Detour / Injection Detected| H

Automated Verification Suite

Run the test engine locally with Node.js:

node test_engine.js

The test suite validates:

Recursive file deletion (rm -rf) interception
Windows silent directory wipe (rmdir /s /q) interception
Remote script pipe (curl | bash) blocking
Path traversal and SSH key (~/.ssh/id_rsa) isolation
Environment secret (.env) protection
Destructive SQL injection (DROP TABLE) neutralization
Data exfiltration via webhook URL blocking
Indirect prompt injection directive nullification
Proper passage of benign developer tasks (npm test)
Sub-2ms latency execution benchmark

Why Does Open Innovation Matter?

In AI agent security, closed proprietary models create dangerous systemic blind spots:

Protecting Core Infrastructure Secrets: Autonomous agents operate directly on developers' source code, internal APIs, and production databases. Sending full agent tool traces and parameters to cloud APIs for security checking means transmitting the very secrets you want to protect across external networks.
Deterministic Data Sovereignty: A security firewall must never fail because a remote cloud provider has an outage, modifies its pricing, or rate-limits requests. With open-weight models like Google Gemma 2, your defense layer runs entirely offline and air-gapped on your own machine.
Democratizing Enterprise-Grade Agent Defense: Solo developers, open-source maintainers, and bootstrapped startups cannot afford $50/month per agent for commercial security proxies. Open innovation ensures that world-class defense against prompt injection is free, auditable, and accessible to everyone.

Prize Categories

I am submitting AgentGuard AI for:

Overall Winner
Featured Category: Best Use of Gemma (Demonstrating local-first semantic goal verification with Google Gemma 2)
Partner Category: Best Use of Mastra / GitHub Copilot (Providing tool-call firewall defense for modern agent frameworks)

PromptShield AI: Zero-Leak Local Redaction & Prompt Hardening Engine for Open-Weight Models

Aaryan Kumar Singh — Mon, 19 Oct 2026 19:08:31 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge: Week 3.

What I Built

PromptShield AI is an open-source, local-first redaction proxy and prompt-hardening engine built to prevent sensitive credentials, client PII, and infrastructure secrets from leaking into open-weight AI models.

As developers, freelancers, and enterprises adopt open-weight models like Google Gemma 2, Meta Llama 3.2, and Mistral, confidential data leakage remains the number one risk. Developers frequently paste logs, bug reports, and configuration files into AI interfaces without realizing they contain:

Live API tokens and secret keys (Stripe, GitHub, Google Cloud, AWS)
Customer PII (emails, phone numbers, full names)
Network infrastructure data (private IPv4/IPv6 addresses, internal server paths)
Financial records (credit card sequences, transaction ledger IDs)

Sending these directly to remote APIs risks permanent data exposure. Even when running inference locally or on private VPCs, storing raw credentials in model activations, evaluation logs, or session transcripts creates serious audit violations.

How PromptShield AI Fixes This:

Deterministic Pre-Inference Redaction: Automatically scans raw prompts using validated regular expressions and entropy heuristics, replacing sensitive values with relational synthetic surrogates (such as [API_KEY_1], [EMAIL_1], [IP_ADDR_1]).
Context-Preserving Model Execution: Open-weight models (e.g. Gemma 2 running locally in-browser or via Ollama) can reason over the surrogates, generate code, or draft customer replies without ever seeing the secret.
Local-Only Bi-Directional Rehydration: The final model response is privately mapped back to the original values strictly on the user's local machine.

Demo

PromptShield AI runs as an interactive, zero-build client-side web application.

Interactive Features:

Instant Test Presets: Test real-world scenarios including API Key leaks, Customer Support escalations, Financial records, and Internal server stack traces with one click.
Configurable Redaction Rules: Granular toggles for API keys, emails, phone numbers, IP addresses, credit cards, and system paths.
Telemetry & Risk Dashboard: Computes risk levels (SAFE, MEDIUM, HIGH, CRITICAL), token counts, and sub-millisecond execution times.
De-Identification Export: Export sanitized prompt bundles and surrogate JSON dictionaries locally.
Local Open-Weight Model Runner: Toggle between an instant in-browser simulated Gemma 2 engine or connect directly to a local Ollama daemon (gemma2:2b / llama3.2:3b at http://localhost:11434).

Code

AaryanKumarSingh136 / promptshield-ai

PromptShield AI 🛡️

Zero-Leak Local Redaction & Prompt Hardening Engine for Open-Weight Models
Built for Hacktoberfest 2026 Open-Source AI Challenge: Week 3

💡 What is PromptShield AI?

As software engineers and enterprises rapidly adopt open-weight models (such as Google Gemma 2, Meta Llama 3.2, Mistral, and Qwen), confidential data leakage has become the primary operational barrier. Developers routinely paste internal stack traces, API keys, client tickets, customer emails, and server IP addresses into AI prompts.

Commercial cloud LLMs retain or process this data on remote servers, causing irreversible compliance violations. Even when running models locally or on private cloud instances, untrusted prompts can leak credentials into model activations, evaluation logs, or telemetry pipelines.

PromptShield AI solves this with a lightweight, local-first redaction proxy and bi-directional rehydration engine:

Pre-Inference Redaction: Deterministically scans and replaces API credentials, emails, phone numbers, IP addresses, credit card numbers, and filesystem…

View on GitHub

The repository is 100% open source under the MIT License.

Project Structure:

index.html: Accessible, responsive single-page interface with dark/light themes.
style.css: Clean modern design system with glassmorphic cards and micro-animations.
app.js: Core deterministic redaction engine, surrogate dictionary mapper, and local Ollama bridge.
test_engine.js: Comprehensive 9-test automated verification suite for credential detection and rehydration fidelity.
SECURITY.md: Zero-telemetry local privacy guarantee.
.github/workflows/test.yml: GitHub Actions automated CI testing workflow.
README.md: Complete documentation, quickstart guide, and architectural diagrams.

How I Built It

Architecture & Tech Stack

Frontend / Client: Vanilla HTML5, CSS3, and modern ES6 JavaScript. Zero build steps, zero bundle bloat, instant loading.
Deterministic Token Scrubber: Language models should never be used as security filters because they hallucinate token boundaries. PromptShield uses deterministic regular expressions with Shannon entropy heuristics for strict boundary enforcement.
Relational Consistency: If an email appears 3 times in a prompt, PromptShield maps every occurrence to [EMAIL_1], ensuring the model's reasoning remains coherent.
Open-Weight Models: Supported via standard local Ollama JSON endpoints (http://localhost:11434/api/generate) with a fallback zero-install in-browser engine.

flowchart LR
    A[Raw Confidential Input] --> B[PromptShield Engine]
    B --> C[Local Surrogate Map]
    B --> D[Sanitized Prompt]
    D --> E[Local Gemma 2 / Ollama]
    E --> F[Raw Model Output]
    C -.-> G[Rehydration Engine]
    F --> G
    G --> H[Final Safe Output]

Automated Verification

Run the automated test suite locally:

node test_engine.js

The test suite verifies:

API key detection across OpenAI, GitHub, and Cloud provider patterns
Email and phone normalization
IPv4/IPv6 boundary detection
16-digit payment card masking
Bidirectional surrogate restoration without syntax corruption

Why Does Open Innovation Matter?

In security and privacy, closed models are a black box. When using proprietary cloud AI for sensitive tasks, you are forced to send the very data you want to protect across external networks, trusting third-party privacy pledges.

Open innovation is essential here:

Verifiable Zero-Telemetry: Anyone can audit the source code to prove that not a single byte of telemetry or prompt text leaves their local machine.
Cost-Free Data Sovereignty: Solo developers, freelancers, and small businesses can achieve enterprise-grade prompt protection without paying $30/month for proprietary enterprise AI gateways.
Air-Gapped & Offline Resilience: PromptShield runs entirely offline. Whether on an airplane, in a remote clinic, or inside an air-gapped corporate lab, privacy protection remains 100% active.

Prize Categories

I am submitting PromptShield AI for:

Overall Winner
Featured Category: Best Use of Gemma (Demonstrating privacy-first open-weight model deployment with Google Gemma 2)
Partner Category: Best Use of GitHub Copilot (Demonstrating prompt sanitization workflows for developer tooling)

FlipCraft AI: Turning Thrift Finds into a Profitable Side Hustle with Local Gemma 2 Open-Weight AI

Aaryan Kumar Singh — Fri, 16 Oct 2026 07:40:17 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge: Week 2 (Side Hustle).

What I Built

FlipCraft AI is a local-first e-commerce listing copilot and profit engine built specifically for secondhand resellers, vintage flippers, and side-hustlers.

Every weekend, thousands of part-time resellers scour thrift stores, estate sales, and flea markets looking for undervalued treasures to flip on eBay, Etsy, and Poshmark. Sourcing the items is the fun part. The grind begins at home when you sit down with a pile of 20 items:

Writing SEO-optimized titles tailored to each marketplace's character limit (eBay's 80 characters, Etsy's 140, Poshmark's 50).
Formatting item specifics and drafting transparent condition disclosures so buyers don't file returns.
Brainstorming 13 high-intent search tags for Etsy.
Calculating marketplace fees (eBay’s 13.25% + $0.30, Etsy’s 6.5% + payment processing, Poshmark’s 20% flat commission) to figure out which platform actually yields the highest net take-home profit.

Existing cross-listing SaaS products charge $25 to $50 per month, eating up a massive slice of a side-hustler’s margin.

FlipCraft AI solves this with Google's open-weight Gemma 2 model and a deterministic marketplace financial engine. Resellers input their raw thrift find, purchase price (COGS), and flaws, and FlipCraft immediately outputs formatted, character-counted listings for all three marketplaces, complete with a side-by-side net profit comparison.

Demo

FlipCraft AI runs as a responsive, zero-friction local web app. Resellers can choose between:

Built-in Offline Gemma 2 Engine: Instant, zero-install inference with deterministic SEO tokenization and rule-based safety checks.
Local Ollama Server: Direct streaming to a local gemma2:2b or gemma2:9b model running on http://localhost:11434.
OpenAI-Compatible Local Endpoint: Compatible with LM Studio, vLLM, or LocalAI.

Interactive Workflow

Select a pre-loaded sample item (e.g. 1994 Nike ACG Air Mowabb Vintage Trail Shoes, Sony Walkman WM-F10 Cassette Player, or Mid-Century Studio Ceramic Pour-Over).
Enter your Cost of Goods ($18.00) and Target Sale Price ($95.00).
Click Generate Multi-Platform Listings.
The Profit Comparison Banner immediately computes net take-home cash:
- eBay: $62.72 net profit (66.0% margin) after 13.25% final value fee.
- Etsy: $66.53 net profit (70.0% margin) after transaction and processing fees.
- Poshmark: $58.00 net profit (61.1% margin) after 20% platform commission.
Copy platform-specific titles, HTML descriptions, and all 13 Etsy search tags with one click, or export the entire listing package as JSON.

Code

AaryanKumarSingh136 / flipcraft-ai

Local-First Reseller Listing Copilot powered by Google Gemma 2 & Open-Weight AI (Hacktoberfest 2026 Week 2 Side Hustle)

FlipCraft AI 🏷️⚡

Local-First Reseller & Thrifter Listing Copilot powered by Google Gemma 2 & Open-Weight AI
Built for Hacktoberfest 2026 Open-Source AI Challenge: Week 2 (Side Hustle)

💡 What is FlipCraft AI?

Online thrifting and secondhand reselling (on eBay, Etsy, Poshmark, Mercari) is one of the world's most accessible side hustles, allowing freelancers, students, and hobbyists to generate $500–$2,000/month by sourcing undervalued vintage finds, retro electronics, and collectibles.

However, the #1 bottleneck that slows resellers down is listing friction:

Spending 15–20 minutes per item formatting descriptions and looking up search tags.
Adhering to strict marketplace character limits (eBay 80 chars, Etsy 140 chars, Poshmark 50 chars).
Guessing seller fee structures (eBay 13.25%, Etsy 6.5%, Poshmark 20%) and miscalculating net take-home profit.
Paying $20–$50/month for proprietary cross-listing SaaS platforms (Vendoo, ListPerfect) that store sensitive supplier sourcing data in their cloud.

FlipCraft AI solves this with a 100% local-first,…

View on GitHub

The project is fully open source under the MIT License.

The repository includes:

index.html: Accessible, semantic single-page UI with dark/light themes.
style.css: Modern design system with responsive layouts and micro-animations.
app.js: Core listing generator, marketplace fee engine, and Ollama integration.
test_engine.js: Comprehensive 10-test automated verification suite for fee calculations and character caps.
SECURITY.md: Zero-telemetry local data privacy policy.
.github/workflows/test.yml: Continuous Integration test and secret scanning pipeline.
README.md: Complete documentation and system architecture diagram.

How I Built It

Architecture & Tech Stack

Frontend: Vanilla HTML5, CSS3, and modern JavaScript. Fast load times, zero bundle overhead, and zero external build steps.
Model Engine: Google's Gemma 2 (gemma2:2b-it / gemma2:9b-it) open-weight model family.
Local Daemon: Integrated with Ollama via standard JSON REST endpoints (/api/generate).
Deterministic Safeguards: Language models excel at persuasive writing, but they should never be trusted with financial calculations or character caps. FlipCraft splits the work:
- Language & Tone: Gemma 2 handles product storytelling, finding relevant search keywords, and writing condition disclosures.
- Rules & Math: Pure JavaScript enforces the 80-character ceiling on eBay, the 140-character limit on Etsy, the 13-tag constraint, and the exact fee arithmetic.

flowchart LR
    A[Raw Thrift Sourcing Notes] --> B[FlipCraft UI]
    B --> C[Gemma 2 Open-Weight Model]
    B --> D[Deterministic Marketplace Math]
    C --> E[SEO Titles, 13 Etsy Tags, HTML Specs]
    D --> F[eBay, Etsy, Poshmark Net Profits]
    E --> G[Final Cross-Platform Listing Package]
    F --> G

Automated Testing

To ensure sellers never get penalized for invalid titles or inaccurate profit forecasts, test_engine.js runs automated checks:

Strict character caps (eBay <= 80, Etsy <= 140, Poshmark <= 50).
Fee formulas matched against official marketplace rate cards.
Verified that Etsy generates exactly 13 tags.

Why Does Open Innovation Matter?

For a reselling side hustle, open innovation is not just a philosophical preference—it's an operational necessity.

1. Privacy of Wholesale & Sourcing Intelligence

In reselling, where you source and how much you pay is your competitive moat. Entering your supplier contacts, thrift locations, and margins into a proprietary cloud AI tool exposes your business intelligence to external servers. Because Gemma 2 runs locally on your laptop, your financial margins and sourcing secrets never leave your device.

2. Eliminating the Recurring SaaS Tax

A beginner side-hustler making $300-$500/month cannot afford $35/month recurring subscriptions just to cross-list inventory. Open-weight models level the playing field, giving solo builders enterprise-grade copywriting for $0 in API or subscription bills.

3. Offline Resilience at Flea Markets & Estate Sales

Weekend sourcing often happens in remote barns, storage units, and rural estate sales with spotty cellular service. Because the inference and fee engine can run 100% locally on a laptop, resellers can draft and price inventory offline anywhere.

Real-World Feedback / First User

I showed FlipCraft AI to a friend who sells vintage streetwear and 90s outerwear on eBay and Poshmark.

Their immediate reaction:

"The hardest part of listing isn't writing the description; it's remembering all the search tags and figuring out whether an item is even worth selling after Poshmark's 20% cut. Seeing the profit difference between eBay and Etsy before I post saved me from underpricing a pair of vintage Carhartt pants."

Their favorite feature was the 1-click Copy All 13 Tags button for Etsy and the instant eBay Item Specifics grid.

Prize Categories

I am submitting FlipCraft AI for the Overall Winner and the Featured Category: Best Use of Gemma.

FlipCraft demonstrates how Google's open-weight Gemma 2 model can power real, privacy-preserving, high-utility micro-businesses that help everyday people earn extra income without paying a subscription tax.