Proposal: Support Multiple LLM Providers via aix Library Integration

[hanXen]

This is a proposal to refactor openrisk's current structure, which currently depends directly on the OpenAI GPT-4o model. The idea is to explore integrating the LLM Provider library from the aix project, so that openrisk could support different LLM providers such as Ollama in addition to OpenAI.

Proposed Approach:

One possible way to approach this might be:

1. Refactor the aix project into a reusable library (e.g., move the Provider logic from internal to pkg and apply the factory pattern).
2. Add the refactored aix as a dependency in openrisk's go.mod.
3. Add --provider and --model flags to the openrisk CLI.
4. Modify the core logic of openrisk to create an LLM Provider instance using aix's provider.New() factory function and request the risk score via the injected Provider interface.

Dependency:
This work would be dependent on the completion (merge) of the Provider library refactoring in the aix project. (Related PR: aix#382)

Potential Benefits:

• Flexibility: Users could select the LLM provider that best suits their needs (e.g., OpenAI, Ollama, etc.).
• Security & Privacy: Local providers would ensure sensitive scan results never leave the user’s environment.
• Cost-Effectiveness: Users could run openrisk without API costs by using locally-hosted models.
• Extensibility: When new LLM providers (e.g., Gemini, Claude) are added to the aix library in the future, openrisk would support them immediately without any code changes.
• Code Reusability: This would avoid duplicating LLM integration logic across multiple tools in the projectdiscovery ecosystem, allowing it to be managed centrally through aix.

We would love to get feedback on this proposal. Does this approach make sense?