variant-analysis

The variant-analysis skill is designed to help security analysts and developers identify similar vulnerabilities and bugs across codebases once an initial issue has been detected. By leveraging pattern-based analysis, this skill enables systematic exploration of code to uncover variants of known bugs, which might manifest in different functions, files, or modules. It addresses the challenge of missed vulnerabilities due to scattered or slightly altered code implementations and reduces the manual effort required to hunt for repetitive or derivative security issues.

Key capabilities of this skill include creating precise initial patterns for known vulnerabilities, identifying points in code that can be safely abstracted, and iteratively generalizing these patterns to find related instances while monitoring false positive rates. It integrates tools such as ripgrep, Semgrep, and CodeQL, enabling fast surface searches, pattern matching, and interprocedural analysis. Additionally, it emphasizes thorough documentation of each match, assessing location, confidence, exploitability, and priority. Core principles include understanding the root cause before searching, starting with exact matches, generalizing one element at a time, and expanding the search across the entire codebase for comprehensive coverage.

This skill is particularly useful for security researchers, penetration testers, and software engineers performing code audits. Typical use cases involve refining or building CodeQL and Semgrep queries, hunting for bug variants, performing systematic vulnerability analysis, and analyzing the propagation of a single root cause across different code paths. It is intended for situations where an initial vulnerability is known, rather than for discovering entirely new issues or conducting general code reviews. Users benefit from structured guidance on iterative pattern generalization and risk-based triage of discovered variants.