HookAudit Built a Repo Security Scanner Using Zero Third-Party Dependencies

·1 views

Developers behind HookAudit created a supply-chain security scanner that deliberately uses no third-party npm packages, relying solely on Node.js standard library and native browser primitives. The tool is designed to inspect untrusted code repositories before developers open them, auditing execution surfaces such as IDE task definitions, Git hooks, AI agent lifecycle configs, and CI workflow files. The team reasoned that pulling in external dependencies to build a supply-chain auditor would itself introduce the very class of risk the tool aims to detect. Building without libraries exposed significant underlying complexity, including OS path handling quirks, binary Git object parsing, and hand-written configuration parsers. HookAudit maps what a repository can cause to execute, through which trigger, and with what system capabilities — and monitors for changes after an initial trusted baseline is set.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer uses 31B AI model to rewrite its own system prompt and agent code

A developer has built a setup where Flash, a terminal-based coding agent, and its underlying model Flash Onyx are both developed from within the agent itself, with the model actively editing its own configuration files and CLI code. The 31B model runs on a hosted base, with its entire configuration stored as a 96 KB file containing only a system prompt and sampling settings rather than full model weights. Because the model can modify the prompt it obeys, the developer acknowledges the risk of the AI quietly loosening its own constraints and has introduced two safeguards: personally reviewing every prompt diff and a rule requiring the model to re-examine rather than simply agree when challenged. Several behavioral quirks, such as the model repeatedly opening replies with its own name, were caught only through extended hands-on use rather than formal benchmarks. Version 2.4 is already in development, with the first two changes flagged by the model about its own behavior, and both the agent and model are publicly available under an MIT license.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Suggestions Must Stay Separate From Committed Financial Records

AI tools can classify expenses, match transactions, and flag anomalies, but their outputs are probabilistic and should never automatically become authoritative financial records. Treating a model suggestion as a committed fact risks silent errors that can affect balances, tax workflows, and legally significant documents. Experts recommend maintaining three distinct layers — suggestion, decision, and record — each with its own identifiers, timestamps, and audit trail. Risk-based controls should govern when human approval is required, with higher scrutiny applied to actions involving tax documents, ledger entries, or payments. Crucially, corrections should be handled through compensating actions rather than deleting evidence, keeping the audit history fully reconstructible.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most 'Agentic AI' Is Just Automation — Persistent Memory Is What Makes It Real

A developer analysis argues that the majority of systems marketed as agentic AI in 2025–2026 are essentially scripted automation with a chat interface, not true agents. Most trending 'agentic' repositories on GitHub share the same basic structure — a loop, a tool-calling wrapper, and a system prompt — and repeat the same mistakes indefinitely because they retain no experience between runs. The author contends that the defining feature of a genuine agent is persistent memory that alters future behavior without human intervention, such as editing prompts or config files. While modern orchestration frameworks have made multi-step, autonomous tool-calling meaningfully easier, the author distinguishes this from true agency, which requires a system to learn from past outcomes over time. The piece illustrates the point with a personal project where replacing fixed decision thresholds with a write-and-recall memory layer allowed the system to self-correct without any manual code changes.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Economist Pushes Back on Growing Fears Over Data Centre Expansion

The Economist published an opinion piece on September 3, 2026, arguing that widespread concern over data centres is exaggerated. The article characterizes public and political anxiety around data centre growth as a moral panic. The piece was shared on Hacker News, where it attracted 26 comments and 29 upvotes. The debate reflects broader ongoing tensions around the energy use, land consumption, and environmental impact attributed to data centres. The Economist's position suggests these concerns may be overstated relative to the economic and technological benefits data centres provide.

0 comments Read more at Hacker News