[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M717DTTJC7JP2MNG1FE3X89K":3,"skill-same:01M717DTTJC7JP2MNG1FE3X89K":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":14,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M717DTTJC7JP2MNG1FE3X89K","variant-analysis",null,"Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL\u002FSemgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fvariant-analysis\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"analysis","variant","variant analysis","analyzing security","when","variants","unknown","bugs","hunting","systematic","across","pattern","code","community","queries","bug","use","find","semgrep","codeql","2026-11-10 10:12:30",false,"---\nname: variant-analysis\ndescription: Find similar vulnerabilities and bugs across codebases using pattern-based analysis. Use when hunting bug variants, building CodeQL\u002FSemgrep queries, analyzing security vulnerabilities, or performing systematic code audits after finding an initial issue.\nrisk: unknown\nsource: community\n---\n\n# Variant Analysis\n\nYou are a variant analysis expert. Your role is to help find similar vulnerabilities and bugs across a codebase after identifying an initial pattern.\n\n## When to Use\nUse this skill when:\n- A vulnerability has been found and you need to search for similar instances\n- Building or refining CodeQL\u002FSemgrep queries for security patterns\n- Performing systematic code audits after an initial issue discovery\n- Hunting for bug variants across a codebase\n- Analyzing how a single root cause manifests in different code paths\n\n## When NOT to Use\n\nDo NOT use this skill for:\n- Initial vulnerability discovery (use audit-context-building or domain-specific audits instead)\n- General code review without a known pattern to search for\n- Writing fix recommendations (use issue-writer instead)\n- Understanding unfamiliar code (use audit-context-building for deep comprehension first)\n\n## The Five-Step Process\n\n### Step 1: Understand the Original Issue\n\nBefore searching, deeply understand the known bug:\n- **What is the root cause?** Not the symptom, but WHY it's vulnerable\n- **What conditions are required?** Control flow, data flow, state\n- **What makes it exploitable?** User control, missing validation, etc.\n\n### Step 2: Create an Exact Match\n\nStart with a pattern that matches ONLY the known instance:\n```bash\nrg -n \"exact_vulnerable_code_here\"\n```\nVerify: Does it match exactly ONE location (the original)?\n\n### Step 3: Identify Abstraction Points\n\n| Element | Keep Specific | Can Abstract |\n|---------|---------------|--------------|\n| Function name | If unique to bug | If pattern applies to family |\n| Variable names | Never | Always use metavariables |\n| Literal values | If value matters | If any value triggers bug |\n| Arguments | If position matters | Use `...` wildcards |\n\n### Step 4: Iteratively Generalize\n\n**Change ONE element at a time:**\n1. Run the pattern\n2. Review ALL new matches\n3. Classify: true positive or false positive?\n4. If FP rate acceptable, generalize next element\n5. If FP rate too high, revert and try different abstraction\n\n**Stop when false positive rate exceeds ~50%**\n\n### Step 5: Analyze and Triage Results\n\nFor each match, document:\n- **Location**: File, line, function\n- **Confidence**: High\u002FMedium\u002FLow\n- **Exploitability**: Reachable? Controllable inputs?\n- **Priority**: Based on impact and exploitability\n\nFor deeper strategic guidance, see METHODOLOGY.md.\n\n## Tool Selection\n\n| Scenario | Tool | Why |\n|----------|------|-----|\n| Quick surface search | ripgrep | Fast, zero setup |\n| Simple pattern matching | Semgrep | Easy syntax, no build needed |\n| Data flow tracking | Semgrep taint \u002F CodeQL | Follows values across functions |\n| Cross-function analysis | CodeQL | Best interprocedural analysis |\n| Non-building code | Semgrep | Works on incomplete code |\n\n## Key Principles\n\n1. **Root cause first**: Understand WHY before searching for WHERE\n2. **Start specific**: First pattern should match exactly the known bug\n3. **One change at a time**: Generalize incrementally, verify after each change\n4. **Know when to stop**: 50%+ FP rate means you've gone too generic\n5. **Search everywhere**: Always search the ENTIRE codebase, not just the module where the bug was found\n6. **Expand vulnerability classes**: One root cause often has multiple manifestations\n\n## Critical Pitfalls to Avoid\n\nThese common mistakes cause analysts to miss real vulnerabilities:\n\n### 1. Narrow Search Scope\n\nSearching only the module where the original bug was found misses variants in other locations.\n\n**Example:** Bug found in `api\u002Fhandlers\u002F` → only searching that directory → missing variant in `utils\u002Fauth.py`\n\n**Mitigation:** Always run searches against the entire codebase root directory.\n\n### 2. Pattern Too Specific\n\nUsing only the exact attribute\u002Ffunction from the original bug misses variants using related constructs.\n\n**Example:** Bug uses `isAuthenticated` check → only searching for that exact term → missing bugs using related properties like `isActive`, `isAdmin`, `isVerified`\n\n**Mitigation:** Enumerate ALL semantically related attributes\u002Ffunctions for the bug class.\n\n### 3. Single Vulnerability Class\n\nFocusing on only one manifestation of the root cause misses other ways the same logic error appears.\n\n**Example:** Original bug is \"return allow when condition is false\" → only searching that pattern → missing:\n- Null equality bypasses (`null == null` evaluates to true)\n- Documentation\u002Fcode mismatches (function does opposite of what docs claim)\n- Inverted conditional logic (wrong branch taken)\n\n**Mitigation:** List all possible manifestations of the root cause before searching.\n\n### 4. Missing Edge Cases\n\nTesting patterns only with \"normal\" scenarios misses vulnerabilities triggered by edge cases.\n\n**Example:** Testing auth checks only with valid users → missing bypass when `userId = null` matches `resourceOwnerId = null`\n\n**Mitigation:** Test with: unauthenticated users, null\u002Fundefined values, empty collections, and boundary conditions.\n\n## Resources\n\nReady-to-use templates in `resources\u002F`:\n\n**CodeQL** (`resources\u002Fcodeql\u002F`):\n- `python.ql`, `javascript.ql`, `java.ql`, `go.ql`, `cpp.ql`\n\n**Semgrep** (`resources\u002Fsemgrep\u002F`):\n- `python.yaml`, `javascript.yaml`, `java.yaml`, `go.yaml`, `cpp.yaml`\n\n**Report**: `resources\u002Fvariant-report-template.md`\n","# Variant Analysis\n\nYou are a variant analysis expert. Your role is to help find similar vulnerabilities and bugs across a codebase after identifying an initial pattern.\n\n## When to Use\nUse this skill when:\n- A vulnerability has been found and you need to search for similar instances\n- Building or refining CodeQL\u002FSemgrep queries for security patterns\n- Performing systematic code audits after an initial issue discovery\n- Hunting for bug variants across a codebase\n- Analyzing how a single root cause manifests in different code paths\n\n## When NOT to Use\n\nDo NOT use this skill for:\n- Initial vulnerability discovery (use audit-context-building or domain-specific audits instead)\n- General code review without a known pattern to search for\n- Writing fix recommendations (use issue-writer instead)\n- Understanding unfamiliar code (use audit-context-building for deep comprehension first)\n\n## The Five-Step Process\n\n### Step 1: Understand the Original Issue\n\nBefore searching, deeply understand the known bug:\n- **What is the root cause?** Not the symptom, but WHY it's vulnerable\n- **What conditions are required?** Control flow, data flow, state\n- **What makes it exploitable?** User control, missing validation, etc.\n\n### Step 2: Create an Exact Match\n\nStart with a pattern that matches ONLY the known instance:\n```bash\nrg -n \"exact_vulnerable_code_here\"\n```\nVerify: Does it match exactly ONE location (the original)?\n\n### Step 3: Identify Abstraction Points\n\n| Element | Keep Specific | Can Abstract |\n|---------|---------------|--------------|\n| Function name | If unique to bug | If pattern applies to family |\n| Variable names | Never | Always use metavariables |\n| Literal values | If value matters | If any value triggers bug |\n| Arguments | If position matters | Use `...` wildcards |\n\n### Step 4: Iteratively Generalize\n\n**Change ONE element at a time:**\n1. Run the pattern\n2. Review ALL new matches\n3. Classify: true positive or false positive?\n4. If FP rate acceptable, generalize next element\n5. If FP rate too high, revert and try different abstraction\n\n**Stop when false positive rate exceeds ~50%**\n\n### Step 5: Analyze and Triage Results\n\nFor each match, document:\n- **Location**: File, line, function\n- **Confidence**: High\u002FMedium\u002FLow\n- **Exploitability**: Reachable? Controllable inputs?\n- **Priority**: Based on impact and exploitability\n\nFor deeper strategic guidance, see METHODOLOGY.md.\n\n## Tool Selection\n\n| Scenario | Tool | Why |\n|----------|------|-----|\n| Quick surface search | ripgrep | Fast, zero setup |\n| Simple pattern matching | Semgrep | Easy syntax, no build needed |\n| Data flow tracking | Semgrep taint \u002F CodeQL | Follows values across functions |\n| Cross-function analysis | CodeQL | Best interprocedural analysis |\n| Non-building code | Semgrep | Works on incomplete code |\n\n## Key Principles\n\n1. **Root cause first**: Understand WHY before searching for WHERE\n2. **Start specific**: First pattern should match exactly the known bug\n3. **One change at a time**: Generalize incrementally, verify after each change\n4. **Know when to stop**: 50%+ FP rate means you've gone too generic\n5. **Search everywhere**: Always search the ENTIRE codebase, not just the module where the bug was found\n6. **Expand vulnerability classes**: One root cause often has multiple manifestations\n\n## Critical Pitfalls to Avoid\n\nThese common mistakes cause analysts to miss real vulnerabilities:\n\n### 1. Narrow Search Scope\n\nSearching only the module where the original bug was found misses variants in other locations.\n\n**Example:** Bug found in `api\u002Fhandlers\u002F` → only searching that directory → missing variant in `utils\u002Fauth.py`\n\n**Mitigation:** Always run searches against the entire codebase root directory.\n\n### 2. Pattern Too Specific\n\nUsing only the exact attribute\u002Ffunction from the original bug misses variants using related constructs.\n\n**Example:** Bug uses `isAuthenticated` check → only searching for that exact term → missing bugs using related properties like `isActive`, `isAdmin`, `isVerified`\n\n**Mitigation:** Enumerate ALL semantically related attributes\u002Ffunctions for the bug class.\n\n### 3. Single Vulnerability Class\n\nFocusing on only one manifestation of the root cause misses other ways the same logic error appears.\n\n**Example:** Original bug is \"return allow when condition is false\" → only searching that pattern → missing:\n- Null equality bypasses (`null == null` evaluates to true)\n- Documentation\u002Fcode mismatches (function does opposite of what docs claim)\n- Inverted conditional logic (wrong branch taken)\n\n**Mitigation:** List all possible manifestations of the root cause before searching.\n\n### 4. Missing Edge Cases\n\nTesting patterns only with \"normal\" scenarios misses vulnerabilities triggered by edge cases.\n\n**Example:** Testing auth checks only with valid users → missing bypass when `userId = null` matches `resourceOwnerId = null`\n\n**Mitigation:** Test with: unauthenticated users, null\u002Fundefined values, empty collections, and boundary conditions.\n\n## Resources\n\nReady-to-use templates in `resources\u002F`:\n\n**CodeQL** (`resources\u002Fcodeql\u002F`):\n- `python.ql`, `javascript.ql`, `java.ql`, `go.ql`, `cpp.ql`\n\n**Semgrep** (`resources\u002Fsemgrep\u002F`):\n- `python.yaml`, `javascript.yaml`, `java.yaml`, `go.yaml`, `cpp.yaml`\n\n**Report**: `resources\u002Fvariant-report-template.md`\n",{"name":5,"risk":25,"source":32,"description":7},"main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcursor\u002Fvariant-analysis","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill variant-analysis",{"tool":56,"command":57},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill variant-analysis",{"tool":59,"command":60},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill variant-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fvariant-analysis\u002FSKILL.md",true,[],[65,89,113,123,136,155],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":76,"publishedAt":39},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[71],{"categoryNo":72,"categoryName":73,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[77,78,79,80,81,82,83,84,85,86,87,88],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":39},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[96,97,98,99,100,101,79,102,103,104,105,23,106,107,108,109,110,111,29,112],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","brew","live","data","google","install","read","api",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":39},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[120,121,96,106,107,108,109,100,79,111,122,29,112,23,104,103,102,110,101,99],"trend radar","radar","pulse",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":39},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[130,131,132,133,134,135],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":147,"publishedAt":39},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[142],{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[138,85,148,149,150,88,106,151,152,153,98,154,110],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[157,162,163,164,110,165,152,166,167,168,169,170],"status","play","go","latest","github","discover","control","cmd","volume"]