.png&w=256&q=75)
🤝 Top Collaborators
.png&w=640&q=75)
🤓 Latest Submissions
GHOST-HUNTER-AI
AI coding assistants now write half of all new code, and they fail in three dangerous ways. They invent packages that do not exist, and attackers register those exact names on PyPI and npm, turning a hallucination into a supply-chain attack. They ignore team architecture, writing raw SQL instead of the ORM wrapper or reinventing internal helpers. And they swallow errors with except Exception: pass and TODO: handle failure placeholders that fail silently in production. Human reviewers cannot reliably catch any of this at PR speed. GhostBuster with its new Module 5, SlopWatch, is a merge gate built for this problem. Three parallel scanners check every PR diff. The Slop Squatting and API Hallucination Registry extracts all imports and verifies each against the live PyPI and npm registries, with typosquat detection and installed-API checks; a nonexistent package triggers a red BLOCK: Warning: Likely AI Hallucination. High risk of supply chain attack. The Blueprint Asserter greps new code against team architecture rules such as no raw SQL and no reinvented timestamp formatters, with custom rules supported. The Ghost Path and Exception Hunter uses AST analysis to flag swallowed exceptions, empty catch blocks, silent fallbacks, and unimplemented failure TODOs. Every finding ships with a concrete fix, and IBM watsonx.ai (Granite) attaches remediation suggestions, falling back to rule templates offline. Fast triage runs on Laya AI in about 33ms; Bob IDE orchestrates the pr_review workflow across five MCP tools. Target users are teams shipping AI-assisted code who need a deterministic, evidence-only gate: it runs from one CLI command on a local path, diff file, or GitHub URL, exits 1 when blocked, and needs zero API keys. What makes it unique is combining registry-grounded hallucination blocking with architecture and error-path checks in a single gate that refuses false accusations, guarded optional imports and version skew are tolerated, proven by scanning the real requests repo with zero BLOCKs while catching every planted flaw in test fixtures.
27 Sep 2026
