Wisp: A JavaScript Snippet Security Ghost in the Machine

A developer built Wisp, a browser-based tool that scans pasted JavaScript snippets for security vulnerabilities and calls a local Gemma model via Ollama only for lines flagged by four in-browser checks. The prompt constrains Gemma to explain marked lines with their citation URLs, and replies are discarded unless the citation is present and every referenced line was actually flagged. Disabling thinking and capping output (think: false, num_predict: 160) cut response time from a 90-second timeout to about 21 seconds.

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine https://dev.to/challenges/hacktoberfest-week4-2026-10-26 I built Wisp. Wisp is a timid ghost that will inspect short JavaScript snippets you paste into her snippet box for security vulnerabilities when you click the "Look at this" button. She will check the snippet and will "mark" four kinds of lines to call Gemma for correction suggestions: Each check owns the safer rewrite and the citation. Gemma is run on Ollama. Gemma is only called for a "marked" line. If the snippet is clean unmarked , Gemma is not called. Clear the snippet box and paste another snippet. Wisp has four emotions. She has an idle emotion where she waits for you to input a snippet. She also has a "reading" expression when she checks the snippet. Her expression turns worried when the snippet needs adjustment. Finally, she is relieved if the snippet check is clean. She does not scan repositories. Nothing needs a login. Everything runs locally, so secrets are never leaked, and nothing is hallucinated. This week's theme for the Hacktoberfest Dev challenge is Ghost in the Machine https://dev.to/challenges/hacktoberfest-week4-2026-10-26 . The theme is to build something spooky or something that honors the past in the spirit of Dia De Los Muertos. I'm just going to go with spooky probably more cute spooky - don't do well with scary, lol . Wisp is a timid ghost who looks at a short JavaScript snippet you paste. Checks in the browser mark a few kinds of risky lines. Gemma, running on this computer through Ollama, explains only those marked lines. A clean snippet never calls the model, and she does not invent a finding. She does not scan a repository or a GitHub account. The page lives in sprite/ . index.html is Wisp, the paste box, and her results. about.html is the same explanation with the citations. wisp.css and wisp.js are the… I started with the sprite and emotions for "Wisp"; Made with HTML, CSS, and JavaScript. The snippet paste box has four different checks that run in the browser, line by line; comments are stripped and placed next to the Wisp. Results are written with DOM methods, not innerHTML. Gemma is only called if a line check is marked. If the snippet check is returned clean, Gemma will not call Ollama. The prompt tells Wisp to explain the line in two or three sentences, including that finding's citation URL, mention no other line number, and not describe an attack, payload, or different fix. The page keeps the reply only when the citation is there and every "line N" is a marked line. Otherwise, it shows "Wisp kept the checker's words." The clear button and the mood selector buttons cancel a look that is still in flight, so a late reply cannot overwrite the page. During my build, a first call left thinking on; the 90-second limit was passed, and the page said that Gemma did not answer. Turning thinking off and capping the reply think: false, num predict: 160 brought an answer back in about 21 seconds. The page will first try gemma4:e4b edge model, then the smaller gemma4:e2b edge model, if the first model is missing. So, now I have the gemma4:e4b edge model running via Ollama on my local machine. Wisp runs on Gemma an open-weight model , locally via Ollama a lightweight and user-friendly tool to help manage LLMs locally . The snippets will never go on a cloud model, so a closed API is not what made the check trustworthy. Since the models stay on the local machine, Wisp will never invent findings or fixes. This project works with the network off once Ollama is running. I don't particularly like being scared, and I don't believe in the Dia de los Muertos. Halloween can be fun to dress up, but I already have insomnia; I don't need to lose any more sleep over horrific AI token expenses or insecure code. So, I made Wisp a timid, cute lil' voodoo ghost girl that helps keep me at ease about my JavaScript, and runs locally on Ollama & Gemma. Best use of Gemma: Wisp runs gemma4:e4b locally via Ollama, with gemma4:e2b as a fallback. This does NOT use a cloud Gemma tag.