Variant Analysis
SkillFrom Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.
Variant Analysis
Find similar vulnerabilities and bugs across codebases using pattern-based analysis.
Author: Axel Mierczuk
When to Use
- Hunt for bug variants after finding an initial vulnerability
- Build CodeQL or Semgrep queries from a known bug pattern
- Perform systematic code audits across large codebases
- Create reusable patterns for recurring vulnerability classes
What It Does
A five-step process: extract the root cause, write a pattern matching only the known bug, generalize it one element at a time, triage what it finds, and report.
Each step has its own strategy reference under skills/variant-analysis/references/.
Entry Points
| Use when | |
|---|---|
/variant-analysis:variants | Workflow, for a large codebase or a root cause with many manifestations. Runs the steps across parallel subagents, one per expansion axis (generalizing variable names, function names, sink APIs, …), looping until the sweep stops finding anything new. Takes bug, root, lang, out as a JSON object, which Claude fills from the current context. Below ~40 source files (the primary language's, excluding vendored and fixture trees) it sweeps narrow and once, because fan-out buys nothing at that size. |
The variant-analysis skill | The knowledge behind the workflow, and the path for a narrow hunt you want to drive yourself — a handful of files, pasted snippets, or a candidate list to triage against a known root cause. Both fire on their own from a conversational "are there others like this?"; measured on a real codebase, Claude reaches for the workflow more often than the skill, so ask for the skill by name if you want to weigh in on each generalization. |
Included
- Tool selection guidance (ripgrep, Semgrep, CodeQL)
- Ready-to-use CodeQL and Semgrep templates for Python, JavaScript, Java, Go, and C++
- A report template, and the pitfalls that most often cause hunts to miss variants
Installation
/plugin install trailofbits/skills/plugins/variant-analysis
Related Skills
codeql— deep interprocedural variant analysissemgrep— fast pattern matching for simpler variantssarif-parsing— process variant analysis results
Related resources
Static Analysis
SkillTrail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.
trailofbits/skills7.6kTrail of Bits Skills
SkillSkills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.
trailofbits/skills7.6k
Semgrep
CLISemantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.
semgrep/semgrep17.1kTrail of Bits Skills
PluginPlugin marketplace from security firm Trail of Bits with 40+ plugins for code auditing, CodeQL/Semgrep static analysis, variant analysis, supply-chain risk, smart contract security and reverse engineering. Codex can load it directly too.
trailofbits/skills7.6kSupply Chain Risk Auditor
SkillTrail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.
trailofbits/skills7.6kSemgrep MCP
MCPSemgrep's official MCP server, now part of the main semgrep repo and started with semgrep mcp: lets agents run static security scans, find issues with custom rules and inspect syntax trees. Requires the Semgrep CLI; connecting to the AppSec platform needs SEMGREP_APP_TOKEN.
semgrep/semgrep17.1k