variant-analysis
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
Profile →npx skills add waybarrios/opencode-power-pack --skill variant-analysis --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Variant Analysis You are a variant analysis expert. Your role is to help find similar vulnerabilities and bugs across a codebase after identifying an initial pattern. ## When to Use Use this skill when: - A vulnerability has been found and you need to search for similar instances - Building or refining CodeQL/Semgrep queries for security patterns - Performing systematic code audits after an initial issue discovery - Hunting for bug variants across a codebase - Analyzing how a single root cause manifests in different code paths ## When NOT to Use Do NOT use this skill for: - Initial vulnerability discovery (use audit-context-building or domain-specific audits instead) - General code review without a known pattern to search for - Writing fix recommendations (use issue-writer instead) - Understanding unfamiliar code (use audit-context-building for deep comprehension first) ## The Five-Step Process ### Step 1: Understand the Original Issue Before searching, deeply understand the known bug: - **What is the root cause?** Not the symptom, but WHY it's vulnerable - **What conditions are required?** Control flow, data flow, state - **What makes it exploitable?** User control, missing vali
- When to Use
- When NOT to Use
- The Five-Step Process
- Step 1: Understand the Original Issue
- Step 2: Create an Exact Match
- Step 3: Identify Abstraction Points
- Step 4: Iteratively Generalize
- Step 5: Analyze and Triage Results
- Tool Selection
- Key Principles
- Critical Pitfalls to Avoid
- 1. Narrow Search Scope
- 2. Pattern Too Specific
- 3. Single Vulnerability Class
rg -n "exact_vulnerable_code_here"
What does the variant-analysis skill do?
Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
How do I install it?
Run `npx skills add waybarrios/opencode-power-pack --skill variant-analysis --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From waybarrios/opencode-power-pack, a repository with 443 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.