skills.rest
marumo333
marumo333COMMUNITY
Explore all skills by this author →
GitHub

variant-analysis

Find similar vulnerabilities across codebases using pattern-based analysis with CodeQL, Semgrep, and ripgrep.

Updated Apr 5, 2026
Search Tags:#static analysis#security audit#variant analysis#codeql#semgrep#vulnerability hunting#taint analysis
One-click install
npx skills add https://github.com/marumo333/atrox --skill variant-analysis-marumo333
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: variant-analysis
Source: https://github.com/marumo333/atrox/tree/main/.claude/skills/trailofbits/plugins/variant-analysis/skills/variant-analysis
Command: npx skills add https://github.com/marumo333/atrox --skill variant-analysis-marumo333

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? After discovering one vulnerability, the same root cause often exists elsewhere in the codebase through copy-paste propagation, developer habits, and incomplete fixes. This Skill provides a systematic methodology to hunt down all variants of a known bug instead of fixing only the single reported instance. ## Core Features & Use Cases - Five-Step Variant Hunting Process: Understand the root cause, create an exact match, identify abstraction points, generalize iteratively, and triage results with controlled false positive rates. - Multi-Tool Query Templates: Ready-to-use Semgrep taint rules and CodeQL templates for Python, JavaScript, Java, Go, and C/C++, plus a structured variant report template. - Use Case: After finding a SQL injection in one Flask endpoint, use this Skill to generalize the pattern, run taint analysis across the entire repository, and produce a report of all confirmed variants with severity and exploitability assessments. ## Quick Start Use the variant-analysis skill to search this entire codebase for other instances of the SQL injection pattern found in api/handlers/user.py.

Frequently Asked Questions about variant-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find similar vulnerabilities after discovering one bug?▼

Start with an exact-match ripgrep pattern for the known vulnerable code, then generalize one element at a time using Semgrep metavariables. Verify matches after each step and stop when the false positive rate exceeds roughly 50 percent.

Should I use Semgrep or CodeQL for variant analysis?▼

Use ripgrep for quick reconnaissance, Semgrep for fast iteration and non-building code, and CodeQL when you need precise cross-function interprocedural data flow analysis. The skill provides templates for both tools across five languages.

What languages do the Semgrep variant analysis templates support?▼

The included Semgrep taint templates cover Python, JavaScript/TypeScript, Java, Go, and C/C++. Each defines language-specific sources like request parameters, sinks like eval or SQL execution, and common sanitizers.

When should I not use variant analysis?▼

Do not use it for initial vulnerability discovery, general code review without a known pattern, or writing fix recommendations. It requires an already-identified bug with an understood root cause as its starting point.

Why does my variant search return too many false positives?▼

High false positive rates mean the pattern is over-generalized. Revert the last abstraction step, add sanitizer patterns, exclude test directories, or add reachability constraints to filter dead code.

Related Skills

Explore More Software Engineering Skills→
ayehiaaayehiaa

variant-analysis

Generate exact-to-generalized search patterns from a confirmed bug's root cause.

Community
Advanced
sbknanasbknana
10

semgrep

Automate static analysis with Semgrep to detect security issues and enforce patterns.

Community
Advanced
ybbms777ybbms777
1

correctness-reviewer

Detect logic errors, edge case flaws, and state management bugs in code reviews.

Community
Intermediate
riparinoriparino
1

offensive-bug-identification

Identify and classify software vulnerabilities across source, binary, and runtime contexts.

Community
Advanced