variant-analysis
Skill by trailofbits · updated · ★ 7.8k
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand. variant-analysis is published by trailofbits on GitHub.
Install variant-analysis
Built from the published package, never by AIgit clone --depth 1 https://github.com/trailofbits/skills /tmp/skills && mkdir -p ~/.claude/skills && cp -r /tmp/skills/plugins/variant-analysis/skills/variant-analysis ~/.claude/skills/variant-analysisRun in your terminal. Claude Code loads skills from ~/.claude/skills automatically.
git clone --depth 1 https://github.com/trailofbits/skills /tmp/skills && mkdir -p ~/.gemini/antigravity-cli/skills && cp -r /tmp/skills/plugins/variant-analysis/skills/variant-analysis ~/.gemini/antigravity-cli/skills/variant-analysisAntigravity CLI loads skills from ~/.gemini/antigravity-cli/skills, or .agents/skills for one project.
Skills can run scripts on your machine. Some need an API key: check the README.
Last commit in the past day
CC-BY-SA-4.0: copyleft, check the terms before using it in a product
Clear description, installs from GitHub, 7,765 stars, original repository
No risky patterns in the files we checked
Weekly newsletter
Like variant-analysis? Get the best new skills every week
The best new tools, security warnings before you install something risky, and one practical tip. Free, three minute read.
Security check
ANo download-and-run commands, hidden instructions or signs of sending keys out were found.
Checked automatically: plugins/variant-analysis/skills/variant-analysis/SKILL.md. This looks for known risky patterns and is not a full audit. How grades work
Inside the skill
-
SKILL.md4 KB -
agents/openai.yaml247 B -
assets/trail-of-bits-mark.svg3 KB -
references/reporting.md2 KB -
references/root-cause.md4 KB -
references/searching.md4 KB -
references/triage.md4 KB -
resources/codeql/cpp.ql3 KB -
resources/codeql/go.ql2 KB -
resources/codeql/java.ql2 KB -
resources/codeql/javascript.ql2 KB -
resources/codeql/python.ql2 KB -
resources/semgrep/cpp.yaml3 KB -
resources/semgrep/go.yaml2 KB -
resources/semgrep/java.yaml2 KB -
resources/semgrep/javascript.yaml2 KB -
resources/semgrep/python.yaml2 KB -
resources/variant-report-template.md1 KB
Alternatives to variant-analysis
All alternatives →Use the local Kaggle CLI skill for command guidance, workflows, and troubleshooting across competitions, datasets, kernels/notebooks, models, model variations and versions, inbox file uploads, forums/discussions, benchmarks, configuration, OAuth/API-token authentication, and accelerator quota. Activate this skill when the user asks about kaggle CLI commands, examples, flags, metadata files, download/upload flows, submissions, benchmark tasks, or Kaggle CLI behavior.
Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements.
Create or redesign enterprise AI, automation, security, and operations product pages that explain system boundaries, approvals, auditability, exceptions, and rollback. Use for dark cinematic heroes, hairline grids, metric pauses, expandable solution rows, case-study evidence, security proof, and qualified demo or waitlist handoffs.
Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.
NestJS best practices and architecture patterns for building production-ready applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper patterns for modules, dependency injection, security, and performance.
variant-analysis: common questions
How do I install variant-analysis?
Run the command above to copy the skill into ~/.claude/skills/. Claude Code picks it up automatically.
Is variant-analysis free?
The code is published under the CC-BY-SA-4.0 licence. The service it connects to may have its own pricing.
Is variant-analysis safe to use?
It scores 90 of 100. Grades: maintenance A, licence C, quality A. Security check: grade A, no risky patterns found in the files checked. Review the code before you install. How grades work.
What are alternatives to variant-analysis?
Similar skills: kaggle-cli, windows-privilege-escalation, operational-enterprise-ai, cloud-penetration-testing.
