variant-analysis_skill

Overview

This skill finds similar vulnerabilities and bug variants across a codebase using pattern-based analysis and iterative generalization. It helps turn one confirmed issue into a systematic search for related instances, producing prioritized findings with confidence and exploitability assessments. Use it to refine hunting queries and guide audits after an initial problem is identified.

How this skill works

The skill inspects a confirmed vulnerable instance, crafts an exact-match pattern, then incrementally abstracts that pattern while reviewing new matches. It supports ripgrep, Semgrep, and CodeQL as tool options depending on speed and analysis depth, and it enforces a one-change-at-a-time workflow to control false positives. Results are triaged with location, confidence, exploitability, and priority annotations.

When to use it

• After finding a concrete vulnerability and you need to locate variants
• When building or refining Semgrep or CodeQL queries for a security pattern
• During systematic code audits following discovery of an initial bug
• When hunting for bug families that share a common root cause
• To analyze how one root cause manifests across different modules and call paths

Best practices

• Start with an exact-match pattern that only hits the original instance
• Generalize one element at a time and review all new matches after each change
• Search the entire repository root; don’t limit scope to a single module
• Enumerate semantically related functions/attributes instead of a single literal
• Stop or revert if false positives exceed ~50% and document reasoning

Example use cases

• Turn a confirmed SQL injection into Semgrep/CodeQL queries to find similar sinks across services
• Generalize an access-control bypass to discover related logic errors in other modules
• Create CodeQL dataflow queries to find tainted-value propagation variants
• Build a prioritized triage report with exploitability and confidence for a security team
• Refine ripgrep-to-Semgrep workflow: exact-match → controlled abstraction → dataflow analysis