Skill and workflow that take one known bug, extract its root cause and hunt the other places it occurs, with CodeQL and Semgrep templates.

How it works

Foe: Breach Spider, a security hole an attacker could use.

Foes

  • Breach Spider

Party · Context

  • RogueYour agent100/100
  1. Breach Spider

    The Breach Spider blocks the way.

    What really happensIt stands for a security hole an attacker could use.

    Rogue: Context 100/100.

  2. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.

  3. Trail of Bits Variant Analysis

    The hero studies the first wound to learn the beast's habits.

    What really happensExtract the root cause of the known bug, then write a pattern that matches only that bug.

    Breach Spider takes 25.

  4. Trail of Bits Variant Analysis

    The net widens one knot at a time.

    What really happensGeneralize the pattern one element at a time, such as variable names, function names or sink APIs, with ripgrep, Semgrep or CodeQL.

    Breach Spider takes 60.

  5. Exploit

    The Breach Spider uses Exploit.

    Rogue takes 11. Rogue: Context 78/100.

  6. Trail of Bits Variant Analysis

    Hunters fan out along every trail the beast could take.

    What really happensOn larger codebases the variants workflow runs parallel subagents, one per expansion axis, and loops until a sweep finds nothing new.

  7. Trail of Bits Variant Analysis

    Look-alikes are weighed before any is called kin.

    What really happensTriage each candidate against the root cause so safe sites are ruled out, then report the variants with the bundled template.

    Breach Spider takes 15. Rogue: Ward. Breach Spider falls.

  8. Victory

    The Breach Spider falls.

Learn this spell

Claude Code

/plugin install trailofbits/skills/plugins/variant-analysis

Codex

codex plugin marketplace add trailofbits/skills
codex plugin add variant-analysis@trailofbits

Notes

Version 2.0.4, by Axel Mierczuk. Starts from a bug you already found; the skill says it is not for initial discovery. /variant-analysis:variants runs a Claude Code workflow with one subagent per expansion axis, and below about 40 source files it does a single narrow sweep. Templates cover Python, JavaScript, Java, Go and C++. Codex: codex plugin marketplace add trailofbits/skills, then codex plugin add variant-analysis@trailofbits. Equippable in Claude Code trials; the Semgrep and CodeQL steps need those tools installed.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.