What I BuiltEvery software engineer knows the feeling of inherited codebases: old logic lingering like phantoms, legacy functions running in production that nobody dares touch, and dormant vulnerabilities that sit silently in the dark.For the Ghost in the Machine theme, I built Code-Spectre—an offline security intelligence tool with a gothic terminal persona. Instead of outputting dry JSON reports or bureaucratic compliance lists, Code-Spectre turns code analysis into an atmospheric séance. It scans repository diffs, identifies dangerous patterns (SQL injection, unsafe deserialization, hardcoded credentials, and path traversal), and speaks back through the terminal as a presence haunting your codebase, guiding you through the "banishment ritual" (the remediation patch).It was designed with a simple philosophy: finding bugs doesn't have to be sterile, and security audits should never require sending your private code to third-party cloud servers.DemoHere is a live simulation of Code-Spectre executing an offline audit against a vulnerable Python endpoint:Bash$ python spectre.py scan src/controllers/user_controller.py
============================================================
👻 [CODE-SPECTRE: THE MACHINE AWAKENS] 👻
[+] Summoning offline intelligence via local weights...
[+] Inhaling syntax tree from: src/controllers/user_controller.py
[!] A presence stirs at line 38...
Spectre Whispers:
"I see what you hid behind the veil of routine maintenance.
In line 38, you concatenated unwashed strings directly into the database query:
query = 'SELECT * FROM users WHERE token = \'' + user_token + '\''
A classic phantom: CWE-89 (SQL Injection). Anyone whispering a quote
can collapse your data boundaries into nothingness."
[BANISHMENT RITUAL]:
"Bind the spirit with parameterized execution:
cursor.execute('SELECT * FROM users WHERE token = %s', (user_token,))"
Verdict: 1 Dormant Phantom Exorcised. The repository sleeps... for now.
CodeThe core script is written in modular Python and requires only a local open-weight runtime (such as Ollama or Hugging Face transformers):Pythonimport sys
import json
import requests
SPECTRE_SYSTEM_PROMPT = """
You are Code-Spectre, an ancient and eerie entity haunting this codebase.
You detect vulnerabilities (injection flaws, insecure credentials, dangerous memory operations, and dead logic).
Respond in an atmospheric, gothic, yet technically precise persona.
Cite the relevant vulnerability/CWE, explain where it lurks, and provide the exact code patch required for the 'Banishment Ritual'.
"""
def consult_spectre(file_path: str, code_content: str, model_name: str = "gemma2:2b"):
payload = {
"model": model_name,
"prompt": f"{SPECTRE_SYSTEM_PROMPT}\n\nInspecting file: {file_path}\n
",
"stream": False,
"options": {
"temperature": 0.4
}
}
try:
response = requests.post("http://localhost:11434/api/generate", json=payload, timeout=60)
response.raise_for_status()
return response.json().get("response", "The spectre remains quiet.")
except requests.exceptions.ConnectionError:
return "[!] The connection to the local spirit plane failed. Make sure Ollama is running locally on port 11434."
if __name__ == "__main__":
sample_code = """
def fetch_user_data(user_id):
query = f"SELECT * FROM accounts WHERE id = {user_id}"
return db.execute(query)
"""
print(consult_spectre("sample.py", sample_code))
How I Built ItCode-Spectre is built around local inference and open-weight architectures: Model Runtime: Leverages quantized open-weight models (like Google's gemma2:2b or llama3.2) through Ollama running entirely on-device (localhost:11434). Context Framing: A deterministic system prompt instructs the open-weight model to adopt a spectral persona without sacrificing technical accuracy, mapping detected smells to concrete Common Weakness Enumeration (CWE) categories.Local AST Pre-parser: Uses Python's native ast module to pre-filter syntax trees for sensitive function calls before piping relevant blocks to the local model, ensuring high throughput and minimal memory overhead.Why Does Open Innovation Matter?Software security is one of the most compelling arguments for open-source AI over closed cloud endpoints:Code Sovereignty & Privacy: Developers and companies cannot risk piping proprietary or pre-release codebase repositories into commercial black-box APIs. Open-weight models ensure that not a single byte of your source code ever leaves the physical machine. True Offline Capability: Code-Spectre functions with the Wi-Fi completely disabled. Whether you're working on an air-gapped system, traveling, or operating through a network outage, your tooling doesn't disappear.Independence from Cloud Economics: No unpredictable token pricing meters, rate-limit throttles, or sudden terms-of-service revisions. The weights run on standard hardware and belong to you indefinitely.My Agent SessionThis architecture and terminal experience were developed through iterative pair-programming with AI agents, focusing on crafting a reliable system prompt for the open-weight model, handling connection exceptions cleanly, and validating AST extraction against common vulnerable test patterns.The Spirit of ItIn software, nothing ever truly disappears. Old commits, hasty hotfixes pushed late at night, and deprecated libraries continue to live quietly in the background of our systems. Code-Spectre doesn't just flag security issues—it turns the process of code review into a dialogue with the history of the machine, reminding us to respect and clean up the footprints we leave behind in our code.Prize CategoriesBest Use of Gemma: Utilizes Google's open-weight Gemma model running via local inference to perform security diagnostics and remediation without cloud reliance.
Top comments (0)