variant-analysis
Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.
Profile →npx skills add vibeeval/vibecosystem --skill variant-analysis --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Variant Analysis When you find a bug, the same mistake almost certainly exists elsewhere. Variant analysis systematically hunts for siblings of a known vulnerability. ## Process ### Step 1: Characterize the Original Bug Before searching, understand what makes this bug a bug: ``` ORIGINAL BUG: File: src/api/users.ts:42 Type: Missing input validation Pattern: req.params.id used directly in DB query without sanitization Root cause: Developer assumed framework sanitizes params Trigger: Untrusted input reaches database query ``` Extract the **abstract pattern** -- not the specific code, but the class of mistake: - Missing validation at a trust boundary - Incorrect error handling in auth path - Race condition between check and use - Hardcoded secret in source - SQL injection via string concatenation ### Step 2: Generate Search Queries For each bug class, create multiple search strategies: #### Grep/Ripgrep (Fast, broad) ```bash # Example: SQL injection via concatenation rg "query\(.*\+.*\)" --type ts rg "execute\(.*\$\{" --type ts rg "\.raw\(.*\+" --type ts # Example: Missing auth middleware rg "router\.(get|post|put|delete)\(" --type ts -l | \ xargs rg -L "authenticate|authorize|requi
- Process
- Step 1: Characterize the Original Bug
- Step 2: Generate Search Queries
- Step 3: Triage Results
- Step 4: Report
- Common Variant Patterns
- Input Validation Variants
- Auth/Authz Variants
- Error Handling Variants
- Crypto Variants
- Race Condition Variants
- Automation Integration
- With coroner agent (post-mortem)
- With security-reviewer agent
rg "query\(.*\+.*\)" --type ts
rg "execute\(.*\$\{" --type ts
rg "\.raw\(.*\+" --type ts
rg "router\.(get|post|put|delete)\(" --type ts -l | \
xargs rg -L "authenticate|authorize|requireAuth"
rg "(password|secret|key|token)\s*[=:]\s*['\"][^'\"]{8,}" --type ts
Find all route handlers
rg "router\.(get|post|put|delete|patch)\(" --type ts -n
Check each for validation middleware
Missing validation = variantWhat does the variant-analysis skill do?
Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill variant-analysis --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 526 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.