domains / families / security / variant-analysis

variant-analysis

combined

Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue. Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.

When to use

• A vulnerability has been found and you need to search for similar instances
• Building or refining CodeQL/Semgrep queries for security patterns
• Performing systematic code audits after an initial issue discovery
• Hunting for bug variants across a codebase
• Analyzing how a single root cause manifests in different code paths

When not to use

• Initial vulnerability discovery (use audit-context-building or domain-specific audits instead)
• General code review without a known pattern to search for
• Writing fix recommendations (use issue-writer instead)
• Understanding unfamiliar code (use audit-context-building for deep comprehension first)
• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
• Initial vulnerability discovery — use audit-context-building or a domain-specific audit

Skill page

Conflict

The trailofbits copy is the canonical, self-contained procedure: it defines the five steps, the stop condition, the failure modes, and points to bundled reference files and query resources. The sickn33 copy is a catalog mirror that reproduces the same five-step structure but adds material the trailofbits copy lacks: an explicit authorization/confirmation gate, a tool-selection table, a concrete abstraction-points table, and a note that the supporting resources are external prerequisites. Because the sickn33 copy contains real steps and constraints (authorization gate, tool selection, abstraction table) that the trailofbits copy does not, crowning one would hide a real alternative. The copies also disagree on whether the supporting resources are bundled (trailofbits) or external prerequisites (sickn33).