skills.rest
AidenSbVevo
AidenSbVevoCOMMUNITY
Explore all skills by this author →
GitHub

variant-analysis

Identify recurring vulnerability patterns across large codebases using Semgrep and CodeQL.

1|Updated Jul 5, 2026
Search Tags:#security#vulnerability#audit#codeql#semgrep#taint-analysis
One-click install
npx skills add https://github.com/AidenSbVevo/claude-code-starter --skill variant-analysis-aidensbvevo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: variant-analysis
Source: https://github.com/AidenSbVevo/claude-code-starter/tree/main/skills/tob-variant-analysis/skills/variant-analysis
Command: npx skills add https://github.com/AidenSbVevo/claude-code-starter --skill variant-analysis-aidensbvevo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill solves the problem of incomplete security fixes by identifying similar vulnerability patterns across an entire codebase after an initial bug has been discovered.

Core Features & Use Cases

  • Pattern Generalization: Provides a structured methodology to climb from exact code matches to semantic taint analysis.
  • Multi-Tool Integration: Offers ready-to-use templates for CodeQL and Semgrep to automate the detection of vulnerability classes.
  • Use Case: After finding a SQL injection in one API handler, use this skill to audit the entire project for similar string concatenation patterns in database queries.

Quick Start

Use the variant-analysis skill to identify all potential code paths where user input might reach a dangerous sink based on the provided vulnerability pattern.

Frequently Asked Questions about variant-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find similar vulnerability patterns across a codebase after finding one bug?▼

You can detect recurring vulnerability patterns across a codebase by applying incremental abstraction techniques to generalize the initial bug into structural matching or taint analysis queries using Semgrep and CodeQL.

What is the best way to use CodeQL and Semgrep together for security audits?▼

Security audits benefit from using CodeQL and Semgrep together by leveraging Semgrep for rapid structural matching and CodeQL for deep taint analysis to systematically hunt and patch bug variants across large codebases.

How do I write a taint analysis query to find SQL injection variants in API handlers?▼

To write a taint analysis query for SQL injection variants, perform root cause analysis on the initial bug to define the source and sink, then use the provided CodeQL or Semgrep templates to track user input reaching dangerous database operations.

Can I use variant analysis to audit an entire project for incomplete security fixes?▼

Yes, you can audit an entire project for incomplete security fixes by tracking recurring vulnerability patterns and leveraging incremental abstraction to identify all potential code paths where user input might reach a dangerous sink based on the original vulnerability.

Does variant analysis require root cause analysis before defining search patterns?▼

Yes, variant analysis requires systematic root cause analysis to effectively define search patterns and triage results, ensuring the generalized queries accurately capture the vulnerability class without generating excessive false positives.

Related Skills

Explore More Software Engineering Skills→
roderikroderik
2

variant-analysis

Map variant vulnerabilities across a codebase using pattern-based analysis.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-sast-opengrep

Author and execute OpenGrep rules for static application security testing.

Community
Advanced
BagelHoleBagelHole
46

sast-scanning

Performs static security testing on source code using Semgrep, CodeQL, and SonarQube.

Community
Intermediate
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced