variant-analysis

Variant analysis skill for finding similar vulnerabilities across a codebase after an initial bug is identified. It guides systematic pattern generalization using ripgrep, Semgrep, and CodeQL, moving from exact matches to broader search patterns while tracking false positive rates. Covers interprocedural analysis, taint tracking, and structured triage of results. Manual variant hunting typically stops at the original file or uses one-off grep patterns that miss semantically related constructs across languages, while this skill enforces incremental generalization with false positive tracking so you cover the full vulnerability class without drowning in noise.