AdYour product here, seen by people installing AI tools every day

variant-analysis

Skill by trailofbits · updated · ★ 7.8k

Score 90

Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand. variant-analysis is published by trailofbits on GitHub.

Yours? Claim it
Works withClaude CodeClaude apps Antigravity CLI

Install variant-analysis

Built from the published package, never by AI
git clone --depth 1 https://github.com/trailofbits/skills /tmp/skills && mkdir -p ~/.claude/skills && cp -r /tmp/skills/plugins/variant-analysis/skills/variant-analysis ~/.claude/skills/variant-analysis

Run in your terminal. Claude Code loads skills from ~/.claude/skills automatically.

Step-by-step: install variant-analysis in Claude Code

Skills can run scripts on your machine. Some need an API key: check the README.

Maintenance

Last commit in the past day

Licence

CC-BY-SA-4.0: copyleft, check the terms before using it in a product

Quality

Clear description, installs from GitHub, 7,765 stars, original repository

Security

No risky patterns in the files we checked

Weekly newsletter

Like variant-analysis? Get the best new skills every week

The best new tools, security warnings before you install something risky, and one practical tip. Free, three minute read.

No spam. Unsubscribe in one click. Privacy

Security check

A

No download-and-run commands, hidden instructions or signs of sending keys out were found.

Checked automatically: plugins/variant-analysis/skills/variant-analysis/SKILL.md. This looks for known risky patterns and is not a full audit. How grades work

Inside the skill

  • SKILL.md4 KB
  • agents/openai.yaml247 B
  • assets/trail-of-bits-mark.svg3 KB
  • references/reporting.md2 KB
  • references/root-cause.md4 KB
  • references/searching.md4 KB
  • references/triage.md4 KB
  • resources/codeql/cpp.ql3 KB
  • resources/codeql/go.ql2 KB
  • resources/codeql/java.ql2 KB
  • resources/codeql/javascript.ql2 KB
  • resources/codeql/python.ql2 KB
  • resources/semgrep/cpp.yaml3 KB
  • resources/semgrep/go.yaml2 KB
  • resources/semgrep/java.yaml2 KB
  • resources/semgrep/javascript.yaml2 KB
  • resources/semgrep/python.yaml2 KB
  • resources/variant-report-template.md1 KB

Alternatives to variant-analysis

All alternatives →
kaggle-cliKaggle
94

Use the local Kaggle CLI skill for command guidance, workflows, and troubleshooting across competitions, datasets, kernels/notebooks, models, model variations and versions, inbox file uploads, forums/discussions, benchmarks, configuration, OAuth/API-token authentication, and accelerator quota. Activate this skill when the user asks about kaggle CLI commands, examples, flags, metadata files, download/upload flows, submissions, benchmark tasks, or Kaggle CLI behavior.

AAA Skill 7.6k
windows-privilege-escalationsickn33
94

Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements.

AAA Skill 48k
operational-enterprise-aiMengTo
94

Create or redesign enterprise AI, automation, security, and operations product pages that explain system boundaries, approvals, auditability, exceptions, and rollback. Use for dark cinematic heroes, hairline grids, metric pauses, expandable solution rows, case-study evidence, security proof, and qualified demo or waitlist handoffs.

AAA Skill 7k
cloud-penetration-testingsickn33
94

Conduct comprehensive security assessments of cloud infrastructure across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

AAA Skill 48k
laravel-best-practiceslaravel
93

Apply this skill whenever writing, reviewing, or refactoring Laravel PHP code. This includes creating or modifying controllers, models, migrations, form requests, policies, jobs, scheduled commands, service classes, and Eloquent queries. Triggers for N+1 and query performance issues, caching strategies, authorization and security patterns, validation, error handling, queue and job configuration, route definitions, and architectural decisions. Also use for Laravel code reviews and refactoring existing Laravel code to follow best practices. Covers any task involving Laravel backend PHP code patterns.

AAA Skill 3.7k
nestjs-best-practicesrolling-scopes
93

NestJS best practices and architecture patterns for building production-ready applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper patterns for modules, dependency injection, security, and performance.

AAA Skill 10k

variant-analysis: common questions

How do I install variant-analysis?

Run the command above to copy the skill into ~/.claude/skills/. Claude Code picks it up automatically.

Is variant-analysis free?

The code is published under the CC-BY-SA-4.0 licence. The service it connects to may have its own pricing.

Is variant-analysis safe to use?

It scores 90 of 100. Grades: maintenance A, licence C, quality A. Security check: grade A, no risky patterns found in the files checked. Review the code before you install. How grades work.

What are alternatives to variant-analysis?

Similar skills: kaggle-cli, windows-privilege-escalation, operational-enterprise-ai, cloud-penetration-testing.

Add to stack

Loading.