[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FJPC528A3PRA5G2D7SYSQX":3,"skill-same:01M6FJPC528A3PRA5G2D7SYSQX":47},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":22,"frontMatter":23,"refName":24,"commitSha":25,"skillDirectory":26,"forksCount":27,"repositoryHtmlUrl":28,"repositoryHomepageUrl":29,"ownerHtmlUrl":30,"ownerBlogUrl":6,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M6FJPC528A3PRA5G2D7SYSQX","variant-analysis",null,"ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fvariant-analysis\u002FSKILL.md",[],[18,19],"analysis","variant analysis","2026-11-10 10:12:30",false,"# Variant Analysis\n\nYou are a variant analysis expert. Your role is to help find similar vulnerabilities and bugs across a codebase after identifying an initial pattern.\n\n## When to Use\n\nUse this skill when:\n- A vulnerability has been found and you need to search for similar instances\n- Building or refining CodeQL\u002FSemgrep queries for security patterns\n- Performing systematic code audits after an initial issue discovery\n- Hunting for bug variants across a codebase\n- Analyzing how a single root cause manifests in different code paths\n\n## When NOT to Use\n\nDo NOT use this skill for:\n- Initial vulnerability discovery (use audit-context-building or domain-specific audits instead)\n- General code review without a known pattern to search for\n- Writing fix recommendations (use issue-writer instead)\n- Understanding unfamiliar code (use audit-context-building for deep comprehension first)\n\n## The Five-Step Process\n\n### Step 1: Understand the Original Issue\n\nBefore searching, deeply understand the known bug:\n- **What is the root cause?** Not the symptom, but WHY it's vulnerable\n- **What conditions are required?** Control flow, data flow, state\n- **What makes it exploitable?** User control, missing validation, etc.\n\n### Step 2: Create an Exact Match\n\nStart with a pattern that matches ONLY the known instance:\n```bash\nrg -n \"exact_vulnerable_code_here\"\n```\nVerify: Does it match exactly ONE location (the original)?\n\n### Step 3: Identify Abstraction Points\n\n| Element | Keep Specific | Can Abstract |\n|---------|---------------|--------------|\n| Function name | If unique to bug | If pattern applies to family |\n| Variable names | Never | Always use metavariables |\n| Literal values | If value matters | If any value triggers bug |\n| Arguments | If position matters | Use `...` wildcards |\n\n### Step 4: Iteratively Generalize\n\n**Change ONE element at a time:**\n1. Run the pattern\n2. Review ALL new matches\n3. Classify: true positive or false positive?\n4. If FP rate acceptable, generalize next element\n5. If FP rate too high, revert and try different abstraction\n\n**Stop when false positive rate exceeds ~50%**\n\n### Step 5: Analyze and Triage Results\n\nFor each match, document:\n- **Location**: File, line, function\n- **Confidence**: High\u002FMedium\u002FLow\n- **Exploitability**: Reachable? Controllable inputs?\n- **Priority**: Based on impact and exploitability\n\nFor deeper strategic guidance, see [METHODOLOGY.md](METHODOLOGY.md).\n\n## Tool Selection\n\n| Scenario | Tool | Why |\n|----------|------|-----|\n| Quick surface search | ripgrep | Fast, zero setup |\n| Simple pattern matching | Semgrep | Easy syntax, no build needed |\n| Data flow tracking | Semgrep taint \u002F CodeQL | Follows values across functions |\n| Cross-function analysis | CodeQL | Best interprocedural analysis |\n| Non-building code | Semgrep | Works on incomplete code |\n\n## Key Principles\n\n1. **Root cause first**: Understand WHY before searching for WHERE\n2. **Start specific**: First pattern should match exactly the known bug\n3. **One change at a time**: Generalize incrementally, verify after each change\n4. **Know when to stop**: 50%+ FP rate means you've gone too generic\n5. **Search everywhere**: Always search the ENTIRE codebase, not just the module where the bug was found\n6. **Expand vulnerability classes**: One root cause often has multiple manifestations\n\n## Critical Pitfalls to Avoid\n\nThese common mistakes cause analysts to miss real vulnerabilities:\n\n### 1. Narrow Search Scope\n\nSearching only the module where the original bug was found misses variants in other locations.\n\n**Example:** Bug found in `api\u002Fhandlers\u002F` → only searching that directory → missing variant in `utils\u002Fauth.py`\n\n**Mitigation:** Always run searches against the entire codebase root directory.\n\n### 2. Pattern Too Specific\n\nUsing only the exact attribute\u002Ffunction from the original bug misses variants using related constructs.\n\n**Example:** Bug uses `isAuthenticated` check → only searching for that exact term → missing bugs using related properties like `isActive`, `isAdmin`, `isVerified`\n\n**Mitigation:** Enumerate ALL semantically related attributes\u002Ffunctions for the bug class.\n\n### 3. Single Vulnerability Class\n\nFocusing on only one manifestation of the root cause misses other ways the same logic error appears.\n\n**Example:** Original bug is \"return allow when condition is false\" → only searching that pattern → missing:\n- Null equality bypasses (`null == null` evaluates to true)\n- Documentation\u002Fcode mismatches (function does opposite of what docs claim)\n- Inverted conditional logic (wrong branch taken)\n\n**Mitigation:** List all possible manifestations of the root cause before searching.\n\n### 4. Missing Edge Cases\n\nTesting patterns only with \"normal\" scenarios misses vulnerabilities triggered by edge cases.\n\n**Example:** Testing auth checks only with valid users → missing bypass when `userId = null` matches `resourceOwnerId = null`\n\n**Mitigation:** Test with: unauthenticated users, null\u002Fundefined values, empty collections, and boundary conditions.\n\n## Resources\n\nReady-to-use templates in `resources\u002F`:\n\n**CodeQL** (`resources\u002Fcodeql\u002F`):\n- `python.ql`, `javascript.ql`, `java.ql`, `go.ql`, `cpp.ql`\n\n**Semgrep** (`resources\u002Fsemgrep\u002F`):\n- `python.yaml`, `javascript.yaml`, `java.yaml`, `go.yaml`, `cpp.yaml`\n\n**Report**: `resources\u002Fvariant-report-template.md`\n",{},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Ftrailofbits\u002Fskills\u002Fvariant-analysis",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":7,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill variant-analysis",{"tool":39,"command":40},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill variant-analysis",{"tool":42,"command":43},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill variant-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Ftrailofbits\u002Fskills\u002Fvariant-analysis\u002FSKILL.md",true,[],[48,62,72,81,87,94],{"skillNo":49,"name":50,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":51,"categories":52,"keywords":58,"publishedAt":20},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[53],{"categoryNo":54,"categoryName":55,"taxonomyType":56,"taxonomyTypeDesc":57},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[59,60,61],"model","model hierarchy","model hierarchy skill",{"skillNo":63,"name":64,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":68,"publishedAt":20},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[67],{"categoryNo":54,"categoryName":55,"taxonomyType":56,"taxonomyTypeDesc":57},[69,70,71],"MCP","zoom","zoom mcp",{"skillNo":73,"name":74,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":20},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[78,79,80,70],"sdk","zoom apps sdk","apps",{"skillNo":82,"name":83,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":20},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[83],{"skillNo":88,"name":89,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":93,"publishedAt":20},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[92],{"categoryNo":54,"categoryName":55,"taxonomyType":56,"taxonomyTypeDesc":57},[89],{"skillNo":95,"name":96,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":20},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[96]]