skills.rest
cropsgg
cropsggCOMMUNITY
Explore all skills by this author →
GitHub

variant-analysis

Identifies all occurrences of a known vulnerability pattern across a codebase.

15|5|Updated May 17, 2026
Search Tags:#security#triage#code-review#codeql#semgrep#variant-analysis#pattern-search
One-click install
npx skills add https://github.com/cropsgg/skills --skill variant-analysis-cropsgg
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: variant-analysis
Source: https://github.com/cropsgg/skills/tree/main/skills/engineering/variant-analysis
Command: npx skills add https://github.com/cropsgg/skills --skill variant-analysis-cropsgg

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Once a bug is found and understood, systematically grep, Semgrep, or CodeQL the entire codebase to find all other occurrences of the same vulnerability class. Find the class, not just the instance.

Core Features & Use Cases

  • Pattern-driven discovery across repositories to identify all siblings of a known vulnerability.
  • Manual triage and classification of hits into true positives, variants, and false positives, with systemic risk assessment.
  • Remediation planning that yields a prioritized fix and actionable steps to prevent recurrence.

Quick Start

Identify all occurrences of a known vulnerability pattern across the codebase and triage hits for remediation.

Frequently Asked Questions about variant-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find all instances of a known vulnerability pattern across my codebase?▼

Variant analysis identifies all sibling occurrences of a known vulnerability class across repositories. After fixing a bug, you apply a defined pattern with Semgrep, CodeQL, or grep to find systemic defects and generate a prioritized remediation plan.

What is the best way to search for similar code vulnerabilities after a postmortem?▼

Variant analysis identifies all sibling occurrences of a known vulnerability class across repositories. After fixing a bug, you apply a defined pattern with Semgrep, CodeQL, or grep to find systemic defects and generate a prioritized remediation plan.

How do I triage CodeQL or Semgrep results for security code review?▼

Variant analysis identifies all sibling occurrences of a known vulnerability class across repositories. After fixing a bug, you apply a defined pattern with Semgrep, CodeQL, or grep to find systemic defects and generate a prioritized remediation plan.

Can I use variant analysis to find duplicate bug patterns in multi-language repositories?▼

Variant analysis identifies all sibling occurrences of a known vulnerability class across repositories. After fixing a bug, you apply a defined pattern with Semgrep, CodeQL, or grep to find systemic defects and generate a prioritized remediation plan.

What do I need to start finding duplicate security vulnerabilities across codebases?▼

Variant analysis identifies all sibling occurrences of a known vulnerability class across repositories. After fixing a bug, you apply a defined pattern with Semgrep, CodeQL, or grep to find systemic defects and generate a prioritized remediation plan.

Related Skills

Explore More Software Engineering Skills→
GoosLabGoosLab

moai-tool-ast-grep

Automates AST-based code search, security scanning, and codemod transformations across multi-language codebases using sg CLI and MoAI-ADK integration.

Community
Advanced
googlegoogle
513

secops-triage

Triage security alerts and cases using the Alert Triage Protocol.

Official
Intermediate
trailofbitstrailofbits
6.5k

variant-analysis

Locate vulnerability variants across a codebase using ripgrep, Semgrep, and CodeQL.

Official
Advanced
jassicsjassics
6

sast-review

Triage SAST findings to rank true vulnerabilities and suggest remediation.

Community
Advanced