Variant Analysis
Plugin ActiveFind similar vulnerabilities and bugs across codebases using pattern-based analysis
To systematically find and analyze similar vulnerabilities and bugs across codebases after an initial issue has been identified.
Features
- Pattern-based analysis for vulnerability variants
- Structured five-step methodology
- Tool selection guidance (Semgrep, CodeQL, ripgrep)
- Ready-to-use templates for multiple languages
- Detailed documentation on pitfalls and principles
Use Cases
- Hunting for bug variants after finding an initial vulnerability
- Building CodeQL or Semgrep queries from a known bug pattern
- Performing systematic code audits across large codebases
- Analyzing security vulnerabilities and finding similar instances
Non-Goals
- Initial vulnerability discovery
- General code review without a known pattern
- Writing fix recommendations
- Understanding unfamiliar code without a prior pattern
Trust
- warning:Issues Attention13 issues opened in the last 90 days, with 4 closed. The closure rate is approximately 23.5%, indicating slow response times for open issues.
Installation
First, add the marketplace
/plugin marketplace add trailofbits/skills/plugin install variant-analysis@trailofbitsContains 1 extensions
Quality Score
Trust Signals
Similar Extensions
Static Analysis
93Static analysis toolkit with CodeQL, Semgrep, and SARIF parsing for security vulnerability detection
C4 Architecture
99Comprehensive C4 architecture documentation workflow with bottom-up code analysis, component synthesis, container mapping, and context diagram generation
Dimensional Analysis
99Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling. Use when someone asks to annotate units in a codebase, perform a dimensional analysis, or find vulnerabilities in a DeFi protocol. Prevents dimensional mismatches and catches formula bugs early.
Ruflo Knowledge Graph
99Knowledge graph construction — entity extraction, relation mapping, and pathfinder graph traversal
Vulnetix
98Vulnerability intelligence and remediation skills for Claude Code — 7 skills for exploit analysis, fix proposals, scoring, exploits, and package security via the Vulnetix VDB API
Semgrep Rule Variant Creator
94Creates language variants of existing Semgrep rules with proper applicability analysis and test-driven validation