variant-analysis
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logi…
它会碰到什么
逐条看命中（15 条严重或高危）
- 高
resources/semgrep/javascript.yaml:22exec-spawn- pattern: child_process.exec($SINK, ...)
- 高
resources/semgrep/javascript.yaml:23exec-spawn- pattern: child_process.execSync($SINK, ...)
- 高
resources/semgrep/javascript.yaml:23exec-spawn- pattern: child_process.execSync($SINK, ...)
- 高
resources/semgrep/javascript.yaml:24exec-spawn- pattern: child_process.spawn($SINK, ...)
- 高
resources/semgrep/javascript.yaml:26exec-spawn- pattern: eval($SINK)
- 高
resources/semgrep/javascript.yaml:56exec-spawn- pattern: eval(...)
- 高
resources/semgrep/javascript.yaml:58exec-spawn- pattern: child_process.exec(...)
- 高
resources/semgrep/javascript.yaml:59exec-spawn- pattern-not: eval("...") - 高
resources/semgrep/python.yaml:22cred-envread- pattern: os.environ.get(...)
- 高
resources/semgrep/python.yaml:27exec-spawn- pattern: os.system($SINK)
- 高
resources/semgrep/python.yaml:28exec-spawn- pattern: os.popen($SINK)
- 高
resources/semgrep/python.yaml:29exec-spawn- pattern: subprocess.call($SINK, ...)
- 高
resources/semgrep/python.yaml:30exec-spawn- pattern: subprocess.run($SINK, ...)
- 高
resources/semgrep/python.yaml:31exec-spawn- pattern: subprocess.Popen($SINK, ...)
- 高
resources/semgrep/python.yaml:33exec-spawn- pattern: eval($SINK)
这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。
技能内容
Variant Analysis
Find the other instances of a bug you have already found. One root cause usually has several
manifestations, and they are rarely in the module where you found the first one.
When to Use
- A vulnerability has been found and you need to search for similar instances
- Building or refining CodeQL/Semgrep queries for security patterns
- Performing systematic code audits after an initial issue discovery
- Analyzing how a single root cause manifests in different code paths
When NOT to Use
- Initial vulnerability discovery — use audit-context-building or a domain-specific audit
- General code review with no known pattern to search for
- Writing fix recommendations — use issue-writer
- Understanding unfamiliar code — use audit-context-building first
The Five Steps
Read the reference for a step when you reach it.
1. Understand the original issue. Extract the root cause — why the code is wrong, not
what it does — and enumerate the directions a variant could hide in: related identifiers,
other manifestations of the same mistake, data-type edge cases.
→ [references/root-cause.md](references/root-cause.md)
2. Create an exact match. Write a pattern matching ONLY the known instance and confirm
it hits. A pattern that matches nothing means you have misunderstood the bug, and every
search built on it is calibrated against the wrong code.
3–4. Generalize one element at a time. Climb from the exact match toward the pattern
family, running and reading all matches after each single change. Stop when more than half
the matches are noise.
→ [references/searching.md](references/searching.md) — abstraction ladder, tool selection,
false-positive filters
5. Triage. Decide which candidates are real, and say so with a severity attached.
→ [references/triage.md](references/triage.md)
Then write it up, including the patterns that failed and a CI rule to prevent regression.
→ [references/reporting.md](references/reporting.md)
Running it as a Workflow
This plugin ships /variant-analysis:variants, which runs the five steps across parallel
subagents — one per expansion axis, looping until the sweep stops finding anything new.
Each stage reads the reference above that matches its job.
Use the workflow when the codebase is large or the root cause has many manifestations. Work
the steps directly when the search is narrow or you want a say in each generalization.
What Makes Hunts Fail
- Narrow scope — searching only the module the original bug was in
- Pattern too specific — searching one attribute and missing the family around it
- One vulnerability class — chasing a single manifestation of the root cause
- Happy-path testing — never trying the null, empty, and boundary cases
- Generalizing too fast — abstracting several elements at once, so noise cannot be
attributed to any one of them
The first three are covered in root-cause.md and searching.md, the fourth in triage.md.
Resources
CodeQL (resources/codeql/): python.ql, javascript.ql, java.ql, go.ql, cpp.ql
Semgrep (resources/semgrep/): python.yaml, javascript.yaml, java.yaml, go.yaml, cpp.yaml
Report: resources/variant-report-template.md
想直接用这个技能？
本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。
它属于哪个仓库
plugins/variant-analysis/skills/variant-analysis/SKILL.md