At inference, PoCSmith is a pipeline from request to formatted artifact. The documented CVE-to-PoC flow: the user gives a CVE ID; the CVE parser fetches and extracts the vulnerability type, affected software, and severity from the NVD API; the context is assembled into a structured prompt matching the training format; the fine-tuned model generates the PoC; and the formatter validates and formats it into working exploit code, saved to output/. The CLI exposes this as cve CVE-2024-1234, with --output and --no-cache.

There are three ways in. The cve command starts from a CVE ID and pulls context from NVD (rate-limited to 5 requests per 30 seconds). The generate command starts from a free-text description via --vuln, --target, and --details, for bugs without a CVE or when the researcher wants to specify the vulnerability directly. The shellcode command starts from a platform and payload type. Supporting commands list platforms and payloads and print the ethical disclaimer. The pipeline’s separation into parser, core engine, generator, and formatter (mirrored in src/parsers, src/core, src/generators, src/formatters) keeps the model invocation in one place and the input/output handling around it, so a new input source or output format is a localized change.