Scankii: The First Static Security Scanner Built to Stop AI Agents from Leaking API Keys

ASHISH — Wed, 01 Jul 2026 15:52:26 +0000

Hey DevHunt community! 👋

I'm incredibly excited to launch Scankii!

As developers, we are building more and more AI Agents using frameworks like LangChain, OpenHands, and AutoGen. The standard paradigm is giving these agents "skills" or "tools" — which are basically just Python functions combined with Natural Language instructions (prompts or docstrings).

But here is the problem: Standard secret scanners (like GitLeaks or TruffleHog) are blind to AI-specific vulnerabilities.

They only scan source code for hardcoded secrets. But what if your Python code securely loads an API key, and your English instructions accidentally trick the agent into printing that key to stdout? The agent framework captures that output, injects it into the LLM context window, and your secret is suddenly exposed. We call this Cross-Modal Leakage.

Enter Scankii. 🛡️

Scankii solves this by analyzing the intersection of your Natural Language and your code. It uses a dual-engine pipeline (NL Semantic Analyzer + AST Syntax Analyzer) to track variable flows between your prompts and your code sinks.

✨ Core Features:

Dual-Engine Scanning: Correlates English instructions with Python ASTs.
Local-First & Fast: Your proprietary agent tools and code never leave your machine.
CI/CD Ready: Outputs standard SARIF reports. Drop it into GitHub Actions or use it as a pre-commit hook.
Framework Agnostic: Works with LangChain, AutoGen, CrewAI, MCP, or any custom python agent framework.

I built Scankii to give developers peace of mind when scaling their agent toolchains. Security shouldn't be an afterthought when building autonomous systems.

I would love for you to try it out on your agent repos, star the project, and leave any feedback or questions below! I'll be here all day answering them. 👇

GitHub Repository: https://github.com/ashp15205/scankii
Installation: pip install scankii

I kept asking AI to fix bugs. It kept refactoring my entire project. Here's how I fixed that.

ASHISH — Wed, 24 Jun 2026 07:34:31 +0000

Every developer using AI tools has hit this at least once.
You ask Cursor or Copilot to fix one bug. It touches 8 files. Three of them weren't related to the bug. One of them broke something else. You spend the next hour undoing what the AI "fixed."
This isn't an AI problem. It's a workflow problem.
The AI had no idea what you wanted from it. Fix surgically? Refactor freely? Plan first? It didn't know. So it guessed. And it guessed wrong.

The root cause
Most developers use the same prompt workflow for every task.
Bug fix. New feature. System design. Quick patch. Same structure. Same expectations. Same results.
The AI treats all of these identically because you treated them identically. You gave it no operating context.

The fix: Operating Modes
I built Vibe Coding Essentials to solve this for myself. The core idea is simple.
Before prompting, set a mode. The mode tells the AI exactly how to behave for this specific task.
4 modes:
[BUILDER] — New features. Move fast. Acceptable tradeoffs. Don't over-engineer.
[MAINTAINER] — Surgical fixes only. Touch nothing outside the scope. No refactors. No new dependencies.
[ARCHITECT] — Plan and structure before a single line of code is written.
[ECONOMY] — Minimal output. Low token use. No padding. No unnecessary files.

Usage is simple:
[MAINTAINER] We have a regression in the billing calculator. Fix only the calculateTotal function. Write a failing test first.
[BUILDER] Build a user authentication flow with email and password. JWT tokens. Don't add OAuth yet.
[ARCHITECT] Design the database schema for a multi-tenant SaaS. No code yet. Just decisions and tradeoffs.

How to get started
60 seconds. No install. No dependencies.

Copy AGENTS.md to your project root
Paste the anti-hallucination rules for your framework into AGENTS.md
Add a mode tag before your next prompt
See if the output changes

That's it.

Why I built this
I got burned. Multiple times.
Context collapse mid-feature. AI adding 4 packages to format a date. A session that cost real tokens and shipped nothing. Code that worked but nobody on the team could understand.
I started documenting every failure. Patterns emerged. The modes came from that.
This is the framework I wish existed when I started using AI tools seriously.

The philosophy
The model generates. The developer decides. You own the workflow.

Contributions welcome — especially if you've been burned by an AI workflow failure that isn't documented yet.

GitHub: https://github.com/ashp15205/vibe-coding-essentials

DEV Community: ASHISH

Scankii: The First Static Security Scanner Built to Stop AI Agents from Leaking API Keys

I kept asking AI to fix bugs. It kept refactoring my entire project. Here's how I fixed that.