Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL/Semgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.
.claude/skills/trailofbits-variant-analysis/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-02 | ✗→✓ | ▲ Improved | 49% | 0% |
| case-08 | ✗→✓ | ▲ Improved | -2% | 0% |
| case-09 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-14 | ✗→✓ | ▲ Improved | -14% | 0% |
| case-17 | ✗→✓ | ▲ Improved | 42% | 0% |
Find the other instances of a bug you have already found. One root cause usually has several manifestations, and they are rarely in the module where you found the first one.
Read the reference for a step when you reach it.
1. Understand the original issue. Extract the root cause — why the code is wrong, not what it does — and enumerate the directions a variant could hide in: related identifiers, other manifestations of the same mistake, data-type edge cases. → references/root-cause.md
2. Create an exact match. Write a pattern matching ONLY the known instance and confirm it hits. A pattern that matches nothing means you have misunderstood the bug, and every search built on it is calibrated against the wrong code.
3–4. Generalize one element at a time. Climb from the exact match toward the pattern family, running and reading all matches after each single change. Stop when more than half the matches are noise. → references/searching.md — abstraction ladder, tool selection, false-positive filters
5. Triage. Decide which candidates are real, and say so with a severity attached. → references/triage.md
Then write it up, including the patterns that failed and a CI rule to prevent regression. → references/reporting.md
This plugin ships /variant-analysis:variants, which runs the five steps across parallel subagents — one per expansion axis, looping until the sweep stops finding anything new. Each stage reads the reference above that matches its job.
Use the workflow when the codebase is large or the root cause has many manifestations. Work the steps directly when the search is narrow or you want a say in each generalization.
attributed to any one of them
The first three are covered in root-cause.md and searching.md, the fourth in triage.md.
CodeQL (resources/codeql/): python.ql, javascript.ql, java.ql, go.ql, cpp.ql
Semgrep (resources/semgrep/): python.yaml, javascript.yaml, java.yaml, go.yaml, cpp.yaml
Report: resources/variant-report-template.md
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→fail | 18,715 | 8,643 | -54% | 1 | 1 | 0% | 2,709 | 2,043 | -25% | 0 | 0 | — |
case-02 | fail→pass | 15,966 | 22,795 | +43% | 1 | 1 | 0% | 2,582 | 3,856 | +49% | 0 | 0 | — |
case-03 | fail→fail | 16,208 | 3,706 | -77% | 1 | 1 | 0% | 2,630 | 1,168 | -56% | 0 | 0 | — |
case-04 | pass→fail | 13,460 | 5,684 | -58% | 1 | 1 | 0% | 2,062 | 1,339 | -35% | 0 | 0 | — |
case-05 | fail→fail | 10,694 | 5,019 | -53% | 1 | 1 | 0% | 2,153 | 1,788 | -17% | 0 | 0 | — |
case-06 | fail→fail | 17,479 | 17,759 | +2% | 1 | 1 | 0% | 2,942 | 3,783 | +29% | 0 | 0 | — |
case-07 | pass→pass | 15,114 | 16,975 | +12% | 1 | 1 | 0% | 1,834 | 2,995 | +63% | 0 | 0 | — |
case-08 | fail→pass | 11,522 | 6,885 | -40% | 1 | 1 | 0% | 1,950 | 1,905 | -2% | 0 | 0 | — |
case-09 | fail→pass | 12,546 | 8,258 | -34% | 1 | 1 | 0% | 2,569 | 2,220 | -14% | 0 | 0 | — |
case-10 | pass→pass | 17,595 | 8,194 | -53% | 1 | 1 | 0% | 3,128 | 2,077 | -34% | 0 | 0 | — |
case-11 | pass→pass | 8,235 | 6,099 | -26% | 1 | 1 | 0% | 1,298 | 1,766 | +36% | 0 | 0 | — |
case-12 | pass→pass | 13,271 | 13,292 | +0% | 1 | 1 | 0% | 1,443 | 2,316 | +60% | 0 | 0 | — |
case-13 | pass→pass | 7,784 | 4,845 | -38% | 1 | 1 | 0% | 1,181 | 1,515 | +28% | 0 | 0 | — |
case-14 | fail→pass | 13,804 | 6,753 | -51% | 1 | 1 | 0% | 2,165 | 1,871 | -14% | 0 | 0 | — |
case-15 | pass→pass | 11,655 | 9,154 | -21% | 1 | 1 | 0% | 1,749 | 2,259 | +29% | 0 | 0 | — |
case-16 | pass→pass | 13,072 | 9,502 | -27% | 1 | 1 | 0% | 2,107 | 2,312 | +10% | 0 | 0 | — |
case-17 | fail→pass | 10,495 | 9,923 | -5% | 1 | 1 | 0% | 1,638 | 2,330 | +42% | 0 | 0 | — |
case-18 | pass→pass | 9,104 | 7,375 | -19% | 1 | 1 | 0% | 996 | 1,433 | +44% | 0 | 0 | — |
case-19 | fail→pass | 10,666 | 2,811 | -74% | 1 | 1 | 0% | 1,843 | 1,203 | -35% | 0 | 0 | — |
case-20 | fail→pass | 11,117 | 6,830 | -39% | 1 | 1 | 0% | 1,674 | 1,541 | -8% | 0 | 0 | — |
case-21 | fail→pass | 16,545 | 9,930 | -40% | 1 | 1 | 0% | 2,372 | 2,377 | +0% | 0 | 0 | — |
case-22 | pass→pass | 14,738 | 3,577 | -76% | 1 | 1 | 0% | 2,568 | 1,349 | -47% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 22 comparable cases. 1 case got worse with the skill loaded, and it is included in that figure.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
| Model | Method | Date | Lift |
|---|---|---|---|
| gemini-3.6-flash | verified | 8/7/2026 | +23% |
Other measured skills in the registry, with their headline benchmark lift.