We Built a Security Scanner That Automates Itself — and Never Touches the Cloud
How AI Security Studio's ASS Script engine lets you record, replay, and narrate a full offline security scan — deterministic analysis first, local LLM reasoning second. Most "AI-powered" security tools have the same dependency: your code has to leave your machine to get an answer. That's a non-starter for a lot of security research — client engagements under NDA, regulated codebases, or just not…
The AI Security Studio (ASS) Script engine enables users to record, replay, and narrate a full offline security scan. Most AI-powered security tools rely on sending code to a cloud, but ASS Script runs everything locally, addressing concerns around NDA client engagements, regulated codebases, and proprietary source sitting in inference logs.
This post details one aspect of ASS Script - the automation engine, ASS Script - and a small offline pipeline used to generate narrated, subtitled walkthrough videos without touching a cloud TTS API.
The automation engine follows a deterministic first approach, with the LLM (local LLM) reasoning second. This means that before any AI touches a finding, it goes through a series of steps: Parser → Rule Engine → Knowledge Retrieval → Summarization → LLM → Reasoning → Finding → Report. The static parsing and deterministic rule engine handle actual discovery tasks like secret detection, header analysis, JWT validation, SQLi/XSS pattern matching.
The LLM only reasons over structured summaries produced by the rule engine, providing explanations and correlations without seeing raw source code.
To create offline narration for demo videos, ASS Script employs a record/play/edit engine built on a node-graph designer. Scripts are written in plain YAML, making them readable and diffable. Nodes represent GUI actions or real scan/analyzer calls, and once recorded, the workflow can be replayed identically from the GUI or CLI.
For the demo videos, a Python script parses a markdown table into timed cues, synthesizes voiceovers offline using macOS's built-in TTS, measures clip durations with ffprobe, concatenates them with ffmpeg, and generates a narration.wav + captions.srt pair entirely from tools already on the machine. This approach ensures no API keys or cloud dependencies, aligning with the project's philosophy of keeping everything local.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
