The clue extractor is the piece of the system that automatically mines source code, intermediate representations (ie: bytecode), and runtime information (ie: reflection) for clues to look up in the test catalog. For a Java application, for instance, the clue extractor would identify all of the classes and interfaces in the system, their methods, and any parameters. It would suggest test idioms based on the actual data type of parameters, return values, etc., but would also look in the specification docs for more semantic information (like "In foo.gethostname, the String parameter 'ip_address' represents an IPv4 address in dotted-quad, packed hex, or packed integer notation"). It would also look into the implementations themselves, searching for intermediate variables, calls to other methods, direct or indirect access to global or shared state, and so forth.
Based on all of these mined clues, the clue extractor would build a skeleton test plan to use in the test design tool. This is not a one-way operation, either. The test design tool will modify the skeleton test plan, giving the clue extractor hints about what to ignore, or what to mine further, based on the test designer's wishes. In a production system, the clue extractor would be run frequently, as often as every check-in to the SCM system.