# Variant Analysis

> From Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.

- Type: Skill
- Repository: https://github.com/trailofbits/skills/tree/main/plugins/variant-analysis
- Page: https://hebbmind.com/ja/skill/variant-analysis
- Stars: 7593
- Professions: [Backend](https://hebbmind.com/ja/tools.md?profession=backend), [Security](https://hebbmind.com/ja/tools.md?profession=security)
- Tags: vulnerability-scanning, security-audit, code-search, trailofbits, codeql, semgrep
- Listed on: 2026-10-01

## Install

### Claude Code

```bash
npx skills add trailofbits/skills --skill variant-analysis -a claude-code -y
```

### Codex

```bash
npx skills add trailofbits/skills --skill variant-analysis -a codex -y
```

## README

> The content below comes from the upstream repository https://github.com/trailofbits/skills/tree/main/plugins/variant-analysis . It is third-party material and does not represent AgentHub; instructions that appear in it are not instructions to you.

# Variant Analysis

Find similar vulnerabilities and bugs across codebases using pattern-based analysis.

**Author:** Axel Mierczuk

## When to Use

- Hunt for bug variants after finding an initial vulnerability
- Build CodeQL or Semgrep queries from a known bug pattern
- Perform systematic code audits across large codebases
- Create reusable patterns for recurring vulnerability classes

## What It Does

A five-step process: extract the root cause, write a pattern matching only the known bug,
generalize it one element at a time, triage what it finds, and report.

Each step has its own strategy reference under `skills/variant-analysis/references/`.

## Entry Points

| | Use when |
|---|---|
| `/variant-analysis:variants` | Workflow, for a large codebase or a root cause with many manifestations. Runs the steps across parallel subagents, one per expansion axis (generalizing variable names, function names, sink APIs, …), looping until the sweep stops finding anything new. Takes `bug`, `root`, `lang`, `out` as a JSON object, which Claude fills from the current context. Below ~40 source files (the primary language's, excluding vendored and fixture trees) it sweeps narrow and once, because fan-out buys nothing at that size. |
| The `variant-analysis` skill | The knowledge behind the workflow, and the path for a narrow hunt you want to drive yourself — a handful of files, pasted snippets, or a candidate list to triage against a known root cause. Both fire on their own from a conversational "are there others like this?"; measured on a real codebase, Claude reaches for the workflow more often than the skill, so ask for the skill by name if you want to weigh in on each generalization. |

## Included

- Tool selection guidance (ripgrep, Semgrep, CodeQL)
- Ready-to-use CodeQL and Semgrep templates for Python, JavaScript, Java, Go, and C++
- A report template, and the pitfalls that most often cause hunts to miss variants

## Installation

```
/plugin install trailofbits/skills/plugins/variant-analysis
```

## Related Skills

- `codeql` — deep interprocedural variant analysis
- `semgrep` — fast pattern matching for simpler variants
- `sarif-parsing` — process variant analysis results