- name
- qlcoder-pure-llm
- description
- Run the pure-LLM variant of the QLCoder workflow for both CVE samples and local Web App repositories. Supports multi-profile taint-flow analysis with source/sink/sanitizer typing for Java Web and Python Web projects without CodeQL/database build steps.
QLCoder Pure LLM
Use this skill to drive pure-llm mode in the local QLCoder project with two workflows:
- CVE sample analysis from manifest (patch/advisory-driven).
- Local repository taint-flow typing for Web App codebases (Java Web, Python Web).
The local workflow now also emits a triaged security finding summary (taint_findings.analysis.*) focused on XSS / SQLi / broken-access-control classes.
Quick Start
- Confirm the workspace contains qlcoder/cli.py.
- Prefer the helper script:
python /Users/aibot/.codex/skills/coder-pure-llm/scripts/run_pure_llm.py --workspace /path/to/workspace
- For CVE mode, optionally pass
--project-slug <slug>or--batch-limit N. - For local Web App mode, pass:
--repo-path /path/to/repo --app-profile auto
- Read generated artifacts under
runs/.../pure-llm/.
Workflow
A. CVE Manifest Mode
- Reuse an existing manifest under
datasets/manifests/when possible. - If missing, build base manifest:
python -m qlcoder.cli build-manifest --base-only --allow-manual-override --manual-base-ref master
- Run single sample (
run-one-pure-llm) or batch (run-manifest-pure-llm). - Summarize:
- summary - source_hypotheses - sink_hypotheses - sanitizer_hypotheses - draft_query_strategy - draft_query_text
B. Local Web App Mode (Java/Python)
- Run:
python /Users/aibot/.codex/skills/coder-pure-llm/scripts/run_pure_llm.py --workspace /path/to/workspace --repo-path /path/to/repo --app-profile auto
--app-profilevalues:
- auto: detect by repository file distribution; mixed repositories can run both Java and Python profiles. - java-web: force Java Web source/sink/sanitizer typing. - python-web: force Python Web source/sink/sanitizer typing.
- First review
taint_findings.analysis.json/mdfor prioritized findings and severity. - Then use
taint_profile.analysis.json/mdfor deeper source/sink/sanitizer trace evidence. - Treat these results as taint-flow leads for manual trace confirmation.
Source/Sink Type Reference
See references/taint_profiles.md for the taxonomy used by the local Web App profile report.
Output Contract
CVE manifest mode artifacts
runs/<project_slug>/pure-llm/iteration_00.prompt.mdruns/<project_slug>/pure-llm/iteration_00.analysis.jsonruns/<project_slug>/pure-llm/iteration_00.analysis.mdruns/<project_slug>/pure-llm/iteration_01.analysis.jsonruns/<project_slug>/pure-llm-summary.json
Local Web App mode artifacts
runs/local-<analysis_name_or_repo>/pure-llm/analysis.jsonruns/local-<analysis_name_or_repo>/pure-llm/analysis.mdruns/local-<analysis_name_or_repo>/pure-llm/taint_profile.analysis.jsonruns/local-<analysis_name_or_repo>/pure-llm/taint_profile.analysis.mdruns/local-<analysis_name_or_repo>/pure-llm/taint_findings.analysis.jsonruns/local-<analysis_name_or_repo>/pure-llm/taint_findings.analysis.md
Treat JSON artifacts as source of truth. Use Markdown for human-readable review.
Notes
- Do not claim CodeQL validation in this mode.
- Missing patch or advisory files are tolerated; the workflow should still proceed using whatever metadata is available.
- Taint profile output is pattern-based candidate analysis, not full dataflow proof.
- Java
${...}sink typing is de-noised to mapper SQL context to avoid commonpom.xml/config placeholder false positives. - The findings summary is heuristic triage; always verify exploitability with targeted trace/tests.
- For detailed command patterns and wrapper usage, read references/workflow.md.