How to Prompt Clearfront AI Security Analyst (and Pivot Like an Investigator)

How do you prompt Clearfront?

Give it one clear identifier and what you want to know. The analyst reads the entity type, chooses the right tools, runs them, and pivots on what comes back. You do not list the tools; you state the target and the goal.

A good prompt is specific about the seed and the intent. Check what my email jane@example.com exposes works. So does dropping in a username, a domain, or an IP with a short instruction. The analyst handles the routing.

How the analyst decides which tools to run

It routes by the type of identifier you give it. An email triggers account and breach checks; a username triggers the enumeration tools; a domain triggers WHOIS and DNS; an IP triggers geolocation and exposure checks.

• -A full name starts with a search-engine footprint and generated dorks
• -An email runs account discovery and breach lookup, plus the avatar check
• -A username runs the broad profile search, then the URL-verified pass
• -A domain runs WHOIS, subdomain discovery, and DNS with mail-security analysis
• -An IP runs geolocation and an exposure check for open services

It also knows what not to do. It will not run a breach lookup on a full name, or a username check on a string with spaces, because those produce noise. The routing is deliberate, which is why vague prompts still return clean results.

Good prompts vs vague prompts

The more precise your seed, the better the report. Compare these.

• -Vague: find stuff about me. Better: scan my email jane@example.com and tell me what is exposed
• -Vague: look up John. Better: check the username johndoe99 across platforms and flag anything tied to my real name

Give it a real identifier and a goal, and it does the rest. Give it a bare name with no context and it can only do so much, the same limit a human investigator would hit.

How to pivot through the evidence graph

In the browser console, click any node in the evidence graph and choose Run more tools on this. The analyst investigates that entity and the graph grows in place with the new connections.

This is where it feels like an investigation rather than a lookup. A breach node leads you to the email it exposed; clicking the email pivots the analyst onto it, and it pulls the accounts and pastes connected to that address. The graph is a dense web, not a star, so following one thread usually surfaces three more.

How to read the report

The report separates what was observed from what was inferred, and it rates every judgment two ways: how likely it is, and how confident the analyst is in the sourcing.

Likelihood uses seven calibrated terms, from almost no chance through roughly even chance to almost certainly, and never vague words like maybe. Confidence is stated separately as high, moderate, or low, based on how good the sourcing is. A finding can be very likely with only moderate confidence, and the report will say so.

Each source is rated for reliability too: a URL you can open and verify is high, an indexed result is moderate, a name-only match is low. That calibration is the difference between a report you can act on and a pile of guesses. The tools reference shows where each source comes from.