pentest

name	pentest
description	Security scanning via clearwing — source code vulnerability hunting and network pentesting.
allowed-tools	["Bash","Read","Write","Grep","Glob"]

Pentest — Clearwing Security Scanner

Authorized security testing using clearwing.

Authorization Check

Before any scanning, confirm authorization with the user. Ask:

1. Is this target owned by you or your organization?
2. Do you have written authorization to test it?
3. What is the scope (source code only, network, or both)?

If authorization is unclear, STOP and do not proceed.

Prerequisites

Check if clearwing is installed:

command -v clearwing && clearwing --version

If not installed:

uv tool install clearwing
clearwing setup  # Interactive LLM provider configuration

Requires: Python 3.10+, uv, Rust toolchain (for native bridge).

Mode 1: Source Code Analysis

Hunt vulnerabilities in source code using the 11-stage pipeline:

# Standard depth — recommended starting point
clearwing sourcehunt <path-to-repo> --depth standard

# Quick scan — faster, less thorough
clearwing sourcehunt <path-to-repo> --depth quick

# Deep scan — comprehensive, takes longer
clearwing sourcehunt <path-to-repo> --depth deep

The pipeline: preprocess → rank files → generate fuzzing harnesses → tiered hunt (6 specialists) → adversarial verification → patch oracle → variant loop → exploit triage → auto-patch → report.

Evidence levels (ascending confidence):

1. suspicion — pattern match, needs investigation
2. static_corroboration — confirmed by static analysis
3. crash_reproduced — fuzzer triggered a crash
4. root_cause_explained — mechanism understood
5. exploit_demonstrated — exploitability confirmed
6. patch_validated — fix verified

Mode 2: Network Scanning

Scan a live target for service vulnerabilities:

# Single host
clearwing scan <target-ip-or-hostname>

# CIDR block (concurrent)
clearwing parallel <CIDR> --max-concurrent 5

Output

Results are stored in SQLite and exported as:

• SARIF — for GitHub Code Scanning integration
• Markdown — human-readable report
• JSON — machine-readable findings

Interactive Mode

For guided exploration:

clearwing interactive
clearwing interactive --resume <session_id>

CI Integration

clearwing ci --sarif-output results.sarif