Skill and workflow that take one known bug, extract its root cause and hunt the other places it occurs, with CodeQL and Semgrep templates.
How it works
Foe: Breach Spider, a security hole an attacker could use.
Foes
- Breach SpiderHaze Poison Ward Insight Flicker Pinned Enraged
Party · Context
- RogueYour agent100/100Haze Poison Ward Insight Flicker Pinned Enraged
The Breach Spider blocks the way.
What really happensIt stands for a security hole an attacker could use.
Rogue: Context 100/100.
The spider strikes through a gap nobody guarded. Its bite lingers.
What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.
Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.
The hero studies the first wound to learn the beast's habits.
What really happensExtract the root cause of the known bug, then write a pattern that matches only that bug.
Breach Spider takes 25.
The net widens one knot at a time.
What really happensGeneralize the pattern one element at a time, such as variable names, function names or sink APIs, with ripgrep, Semgrep or CodeQL.
Breach Spider takes 60.
The Breach Spider uses Exploit.
Rogue takes 11. Rogue: Context 78/100.
Hunters fan out along every trail the beast could take.
What really happensOn larger codebases the variants workflow runs parallel subagents, one per expansion axis, and loops until a sweep finds nothing new.
Look-alikes are weighed before any is called kin.
What really happensTriage each candidate against the root cause so safe sites are ruled out, then report the variants with the bundled template.
Breach Spider takes 15. Rogue: Ward. Breach Spider falls.
The Breach Spider falls.
Learn this spell
Claude Code
/plugin install trailofbits/skills/plugins/variant-analysisCodex
codex plugin marketplace add trailofbits/skills
codex plugin add variant-analysis@trailofbitsNotes
Version 2.0.4, by Axel Mierczuk. Starts from a bug you already found; the skill says it is not for initial discovery. /variant-analysis:variants runs a Claude Code workflow with one subagent per expansion axis, and below about 40 source files it does a single narrow sweep. Templates cover Python, JavaScript, Java, Go and C++. Codex: codex plugin marketplace add trailofbits/skills, then codex plugin add variant-analysis@trailofbits. Equippable in Claude Code trials; the Semgrep and CodeQL steps need those tools installed.
This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.

