variant-analysis
An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, code-quality, research, security.
What it does
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill variant-analysisOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/variant-analysis/skills/variant-analysis ~/.claude/skills/variant-analysisSafety box score
Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a read-only variant-analysis workflow: it helps an agent search a codebase for more instances of a known bug and write a report. It does not ship executable tooling or external network actions; the main risks are limited to ordinary code-reading and the analysis patterns it suggests.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | No shipped scripts or evaluative code; the repo contains markdown guidance, Semgrep YAML, and a text SVG asset only. |
| Network access | 0 (none) | No code or config performs downloads or sends data to remote hosts; there are no endpoints or fetch steps in the shipped files. |
| Filesystem reach | 0 (none) | The skill only reads the codebase for analysis and writes a report template conceptually; it does not instruct edits or deletions outside the project. |
| Secrets & credentials | 0 (none) | No references to tokens, keychains, browser sessions, `.env` files, or asking the user to paste secrets appear in the shipped content. |
| Privilege & persistence | 0 (none) | Nothing requests sudo, global installs, services, scheduled tasks, or shell/OS configuration changes. |
| Instruction hijack surface | 0 (none) | There are no instructions to ignore higher-level rules, hide output, follow remote content, or adopt a deceptive persona. |
| Irreversible actions | 0 (none) | The skill is analysis-only; it does not push, merge, deploy, send messages, pay, book, or delete anything. |
| Transparency | 0 (none) | All shipped files are human-readable text; there are no binaries, base64 blobs, or installer payloads. |
Before installing
- Read `SKILL.md` and the Semgrep rules to confirm it is analysis-only and does not modify files.
- Check whether your workflow allows the agent to run local search tools like Semgrep or CodeQL on the full repository.
- Verify there are no hidden companion scripts in the installed package beyond the files shown here.
Rated 2026-10-20 by an automated review of 13 files from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/variant-analysis/skills/variant-analysis/SKILL.md
- Branch
- main
- Collection
- variant-analysis
- Updated
- 2026-09-19
Related skills
- audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
- audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
- c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
- code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.
- constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
- differential-review — Performs security-focused differential review of code changes.