Use an LLM as a Security Judge to Prioritize Codebase Analysis

You're a security expert. Here's the different kinds of files we're looking at: C++ files, IPDL files, Web IDL files. Here is some detail about each... Now, give me two scores. One score is how likely do you think there's a memory safety issue? And another is how easy could you access this from a webpage?

You are a security expert specializing in [language, e.g., C++]. I will provide you with the content of a source code file. Your task is to analyze it and provide two scores on a scale of 1-10. 1. Likelihood Score: How likely is this file to contain a [vulnerability type, e.g., memory safety issue]?
2. Accessibility Score: How easily could this code be accessed or exploited by an external actor, for example, from a public webpage or API endpoint? Return only the two scores in a parsable format like this:
Likelihood: [score]/10
Accessibility: [score]/10 Here is the file content:
[paste source code]

Set up a script to feed each target file, or relevant sections of code, to the LLM with your prompt. Parse the two scores from each response and compile them into a single list. Sort this list to rank files from highest to lowest risk, based on the scores.

My actual values:
[insert the files, settings, accounts, or constraints for this step]

Give me the exact commands, settings, or output to use. Finish with a pass or fail check for generate a ranked list.

Use the final ranked list to prioritize the work of a more resource intensive process, like an automated bug hunting agent. By feeding the agent the highest risk files first, you focus expensive compute cycles on the most likely targets.

My actual values:
[insert the files, settings, accounts, or constraints for this step]

Give me the exact commands, settings, or output to use. Finish with a pass or fail check for feed the prioritized list to a bug hunter.