Find Similar Vulnerabilities Across Your Codebase

Variant Analysis finds other instances of a vulnerability or bug across a codebase once one instance is already known, through a five-step process: understand the root cause (not just the symptom - what conditions and data flow make it exploitable), write a pattern that matches only the exact known instance:

rg -n "exact_vulnerable_code_here"

then identify which elements can be abstracted (variable names always become metavariables, function names only if the pattern applies to a whole family, literal values only if any value triggers the bug), generalize one element at a time - reviewing every new match as a true or false positive after each change, and stopping once the false-positive rate exceeds roughly 50% - and finally triage every match by location, confidence, exploitability, and priority. It is explicitly authorized-use only: any command that probes, exploits, or extracts data from a real target requires the user to state the exact target, confirm written authorization and scope, and explicitly approve the shown commands first; without that confirmation the skill stays read-only and gives defensive guidance only.

Use it once a vulnerability is already found and needs searching for similar instances, when building or refining CodeQL or Semgrep queries for a security pattern, for a systematic audit after an initial issue discovery, or to see how one root cause manifests across different code paths. It is not for initial vulnerability discovery, general code review with no known pattern to search for, or writing fix recommendations - those are separate skills. The critical pitfalls it names by name: searching only the module where the bug was found instead of the whole codebase root, matching only the exact attribute name instead of every semantically related one (isAuthenticated but missing isActive/isAdmin/isVerified), fixating on one manifestation of a root cause instead of enumerating all of them (a broken "return allow when false" check can also show up as a null-equality bypass or inverted conditional), and testing only normal-user scenarios instead of unauthenticated, null, empty, and boundary cases.

Input is a known bug's exact vulnerable code pattern. Output is a triaged list of matches across the entire codebase, each with location, confidence (high/medium/low), exploitability, and priority, following ready-made templates under resources/variant-report-template.md.

ripgrep for a fast surface search, Semgrep for pattern matching (including on non-building or incomplete code) and taint/data-flow tracking, and CodeQL for the strongest cross-function, interprocedural analysis. Ready-to-use query templates ship for Python, JavaScript, Java, Go, and C++ under resources/codeql/ and resources/semgrep/.

Security researchers and engineers doing authorized code audits who have already found one instance of a bug class and need to find every other place the same root cause shows up in the codebase, not just the module where it was first spotted.