WSQF-AI extends Prof. Hironori Washizaki's Waseda Software Quality Framework (WSQF/WSQB) to AI-era repositories — measuring real ISO/IEC 25010/25059 characteristics against your source, instead of asking a model to guess a score.
Output from an actual wsqfai https://github.com/pallets/flask run against Flask's real source.
| Severity | Sub-characteristic | Finding | Location |
|---|---|---|---|
| high | reliability / fault_tolerance | Bare 'except:' clause | src/flask/app.py |
| medium | maintainability / modularity | Large file reduces modularity | src/flask/cli.py |
| medium | reliability / fault_tolerance | Swallowed exception | src/flask/config.py |
| medium | portability / installability | Unpinned dependencies | examples/tutorial/pyproject.toml |
| File | Fix |
|---|---|
src/flask/app.py | Narrowed bare 'except:' to 'except Exception:' so SystemExit/KeyboardInterrupt/GeneratorExit propagate normally. |
Flask's exec() hypothesis stays unverified, honestly — sandbox verification only covers one mechanically reconstructible shape so far (a direct single-parameter shell-exec call). Point it at code that is that shape, and the sandbox actually proves the exploit instead of trusting the pattern:
| Severity | Sub-characteristic | Finding | Location |
|---|---|---|---|
| critical | security / integrity | Proven command injection in ping_host() sandbox-confirmed | netdiag.py |
The exact same static pattern in a function that validates its input first is correctly cleared instead — verification runs the real code, it doesn't trust the match.
A milestone is only marked done once it's real, tested code — never because a plan for it exists.