Variant Analysis
Find similar vulnerabilities and bugs across codebases using pattern-based analysis
- Type
- Plugin
- Repository
- trailofbits/skills
- GitHub stars
- 7.3k
- License
- CC-BY-SA-4.0
- Repo last updated
- Sep 25, 2026
- Version
- 2.0.4
- Author
- Axel Mierczuk
What Variant Analysis is
Variant Analysis is a plugin published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”
A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.
Installing Variant Analysis adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.
How to install Variant Analysis
Claude Code
- Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills
- Install the plugin: claude plugin install variant-analysis@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
- Restart the session if the new skills or commands don't appear straight away.
Claude Cowork
- Open Customize → Plugins and choose Add marketplace.
- Enter trailofbits/skills (the owner/repo shorthand works for GitHub).
- Find Variant Analysis in the list, click Install, then connect any connectors it needs from its Connectors tab.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/variant-analysis/.claude-plugin/plugin.json, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.
Find similar vulnerabilities and bugs across codebases using pattern-based analysis.
Author: Axel Mierczuk
When to Use
- Hunt for bug variants after finding an initial vulnerability
- Build CodeQL or Semgrep queries from a known bug pattern
- Perform systematic code audits across large codebases
- Create reusable patterns for recurring vulnerability classes
What It Does
A five-step process: extract the root cause, write a pattern matching only the known bug, generalize it one element at a time, triage what it finds, and report.
Each step has its own strategy reference under skills/variant-analysis/references/.
Entry Points
Included
- Tool selection guidance (ripgrep, Semgrep, CodeQL)
- Ready-to-use CodeQL and Semgrep templates for Python, JavaScript, Java, Go, and C++
- A report template, and the pitfalls that most often cause hunts to miss variants
Installation
/plugin install trailofbits/skills/plugins/variant-analysisRelated Skills
- codeql — deep interprocedural variant analysis
- semgrep — fast pattern matching for simpler variants
- sarif-parsing — process variant analysis results
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Variant Analysis?
Variant Analysis is a plugin for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Find similar vulnerabilities and bugs across codebases using pattern-based analysis
How do I install Variant Analysis in Claude Code?
Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills Install the plugin: claude plugin install variant-analysis@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.
Can I use Variant Analysis in Claude Cowork?
Open Customize → Plugins and choose Add marketplace. Enter trailofbits/skills (the owner/repo shorthand works for GitHub). Find Variant Analysis in the list, click Install, then connect any connectors it needs from its Connectors tab.
Is Variant Analysis safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Zeroize Audit Detects missing or compiler-optimized zeroization of sensitive data with assembly and control-flow analysis Plugin · trailofbits/skills
- Yara Authoring YARA-X detection rule authoring with linting and quality analysis Plugin · trailofbits/skills
- 3 Tu Compiler Analyzer Performs per-TU compiler-level analysis (IR diff, assembly, semantic IR, CFG) for zeroize-audit. One instance runs per translation unit, enabling parallel execution across TUs. Subagent · trailofbits/skills
- 0 Preflight Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces merged-config.yaml, preflight.json, and orchestrator-state.json. Subagent · trailofbits/skills
- Workflow Skill Design Teaches design patterns for workflow-based Claude Code skills and provides a review agent for auditing existing skills Plugin · trailofbits/skills
- Trailmark Builds source and binary code graphs for security analysis, context slicing, mutation testing, cryptographic protocol modeling, finding triage, and variant analysis. Plugin · trailofbits/skills
- Testing Handbook Skills Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide) Plugin · trailofbits/skills
- Supply Chain Risk Auditor Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts Plugin · trailofbits/skills