Attacker-first static analysis for the AI agent era.

The problem

I've been in this industry long enough to watch the same cycle repeat. Every new security tool promises to solve what came before. Static analysis tools flood teams with false positives. Code review bots miss the real stuff. The pattern is always the same, scan backward from sinks and call it security.

The fundamental flaw in traditional static analysis is that it starts at the wrong end of the problem. It looks for suspicious patterns near dangerous API calls, flags everything that touches user input, and hands you a report full of things that aren't actually exploitable. Teams drown in noise and miss what matters.

The approach

ClawHunter works the other way around. It starts at entry points, every place external data enters your codebase, and traces forward through actual data flows to see if it can reach a dangerous sink. Then, crucially, it actively tries to disprove its own findings.

This is called falsification: instead of just finding something suspicious and calling it a vulnerability, the tool runs through a checklist of security controls, input validation, authentication checks, scope enforcement, output encoding, and only reports what survives that scrutiny. If there's even one safe path that neutralizes the input, the finding gets downgraded.

Three phases

1. Reconnaissance

A sub-agent maps the attack surface before looking for specific vulnerabilities. It enumerates every entry point (HTTP handlers, CLI args, message queues, file uploads) and every sink (database queries, command execution, eval calls). The output is a partition table grouping your code by its exposure profile.

2. Hunt + Falsification

The main agent traces forward through data flows using a structured investigation discipline: read the entry point, follow every function call across files, exhaust all code paths (one safe path doesn't clear the input), follow through stores and outbound responses, then confirm unsanitized reachability at the sink. After identifying candidates, it runs the falsification engine to actively disprove each one.

This is where a stronger model matters most, holding complex data-flow chains in context while actively trying to disprove them requires deep reasoning. ClawHunter supports offloading this phase to external LLM APIs (Grok, Anthropic Opus, OpenAI o3) when you need that extra power.

3. Report

For each verified vulnerability, it produces a structured report with the attack path, exploitability evidence, structural flaw explanation, proposed fix with diff, and impact assessment. No vague "low impact" hand-waving, if it passes all gates (reachable, attacker-controlled, new capability), it gets reported.

Why open source

The methodology behind ClawHunter was developed by Capital One's security team and released as VulnHunter. It's the same approach that found thousands of high-severity vulnerabilities across their codebase, including a 27-year-old OpenBSD bug. I adapted it for OpenClaw because the cybersecurity industry needs tools that are easily accessible to improve adoption and raise application security posture.

ClawHunter runs as an OpenClaw skill, uses sub-agents for parallel analysis, and supports both local models (Qwen 35B is sufficient for many real-world codebases) and external API providers when you need more reasoning power. It's Apache 2.0, free to use, fork, and contribute to.

Getting started

# Run against a local repo (read-only mode by default)
/clawhunter /path/to/repo --mode read-only

# Or route Phase 2 through an external LLM for deeper analysis
/clawhunter --model grok

The full documentation, including provider configuration and CI/CD integration notes, is in the repository.

A note on responsibility

This tool performs dual-use cybersecurity work: vulnerability discovery and exploitation analysis. That means it can trigger safety mechanisms at multiple layers, not just from the LLM provider but also from the platform running it.

What can trigger safeguards

LLM providers. Frontier model providers (Anthropic, OpenAI, xAI) have increasingly aggressive real-time cyber guardrails. ClawHunter's prompts contain attacker-first reasoning patterns: data-flow tracing toward dangerous sinks, falsification of security controls, and exploitability assessment. These patterns may be flagged as potentially malicious even when used for legitimate security auditing. If you run it against an Anthropic account not enrolled in their Cyber Verification Program, requests may be blocked and your usage flagged for abuse review.

OpenClaw. OpenClaw itself has safety layers that monitor agent behavior. Because ClawHunter instructs the model to reason about exploitability, trace attack paths, and propose fixes for real vulnerabilities, it can trigger OpenClaw's own content filters or behavioral safeguards, especially in sessions with stricter moderation settings. You may see warnings, blocked tool calls, or session interruptions.

Your infrastructure. If ClawHunter is running in a CI/CD pipeline, shared workspace, or multi-user environment, the output (exploit traces, vulnerability reports) contains sensitive information about your codebase's security posture. Treat it like any other security audit artifact. Restrict access and do not commit findings to public repos without redaction.

Proceed with caution

• Only scan codebases you are explicitly authorized to analyze. This includes third-party dependencies only if you have permission from the owner or maintainer.
• Be aware of what you're testing. ClawHunter does more than find bugs. It constructs plausible attack narratives. Understanding the methodology helps you interpret results correctly and avoid false confidence in either direction (over-reporting or under-reporting).
• Use read-only mode for untrusted code. Bash-enabled mode installs dependencies and can execute proof-of-concept exploits. Never use this on codebases where you don't have explicit authorization to modify state.
• Follow responsible disclosure best practices. If ClawHunter finds vulnerabilities in third-party software, report them through the maintainer's preferred channel (security.txt, vulnerability database, direct contact). Don't publish exploit details publicly without coordination.
• Enroll in provider verification programs if you plan heavy use. Anthropic's Cyber Verification Program is designed for exactly this kind of work. It reduces the chance of false-positive abuse flags and gives you access to stronger models optimized for security analysis.

ClawHunter is a tool, not a verdict. The findings it produces are starting points for human review, not automated determinations of exploitability or risk.