variant-analysis

Name: variant-analysis
Availability: InStock
Author: aidensbvevo

Identify recurring vulnerability patterns across large codebases using Semgrep and CodeQL.

1|Updated Jul 5, 2026

Search Tags:#security #vulnerability #audit #codeql #semgrep #taint-analysis

Ready to run

npx skills add https://github.com/AidenSbVevo/claude-code-starter --skill variant-analysis-aidensbvevo

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: variant-analysis
Source: https://github.com/AidenSbVevo/claude-code-starter/tree/main/skills/tob-variant-analysis/skills/variant-analysis
Command: npx skills add https://github.com/AidenSbVevo/claude-code-starter --skill variant-analysis-aidensbvevo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill solves the problem of incomplete security fixes by identifying similar vulnerability patterns across an entire codebase after an initial bug has been discovered.

Core Features & Use Cases

Pattern Generalization: Provides a structured methodology to climb from exact code matches to semantic taint analysis.
Multi-Tool Integration: Offers ready-to-use templates for CodeQL and Semgrep to automate the detection of vulnerability classes.
Use Case: After finding a SQL injection in one API handler, use this skill to audit the entire project for similar string concatenation patterns in database queries.

Quick Start

Use the variant-analysis skill to identify all potential code paths where user input might reach a dangerous sink based on the provided vulnerability pattern.

Frequently Asked Questions about variant-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find similar vulnerability patterns across a codebase after finding one bug?▼

You can detect recurring vulnerability patterns across a codebase by applying incremental abstraction techniques to generalize the initial bug into structural matching or taint analysis queries using Semgrep and CodeQL.

What is the best way to use CodeQL and Semgrep together for security audits?▼

Security audits benefit from using CodeQL and Semgrep together by leveraging Semgrep for rapid structural matching and CodeQL for deep taint analysis to systematically hunt and patch bug variants across large codebases.

How do I write a taint analysis query to find SQL injection variants in API handlers?▼

To write a taint analysis query for SQL injection variants, perform root cause analysis on the initial bug to define the source and sink, then use the provided CodeQL or Semgrep templates to track user input reaching dangerous database operations.

Can I use variant analysis to audit an entire project for incomplete security fixes?▼

Yes, you can audit an entire project for incomplete security fixes by tracking recurring vulnerability patterns and leveraging incremental abstraction to identify all potential code paths where user input might reach a dangerous sink based on the original vulnerability.

Does variant analysis require root cause analysis before defining search patterns?▼

Yes, variant analysis requires systematic root cause analysis to effectively define search patterns and triage results, ensuring the generalized queries accurately capture the vulnerability class without generating excessive false positives.