--- title: "Variant Analysis - Air Market" description: "You just found a bug in one file, and now you are wondering if the same mistake was made somewhere else. This helps you go looking for the other copies. It can also take the one bug you have and buil…" canonical: "https://airmarket.ai/app/variant-analysis" --- [Air Market](/) / [Security](/category/security) / Variant Analysis Skill by [Trail of Bits](/@trailofbits) # Variant Analysis You found one bug - now find every other copy of it ## What this does You just found a bug in one file, and now you are wondering if the same mistake was made somewhere else. This helps you go looking for the other copies. It can also take the one bug you have and build a search for that whole pattern, then check a pile of similar-looking hits against the original. It is not for starting a hunt with nothing in hand. ### Top 3 things it does for you - Ask whether the same bug exists elsewhere in the code - Turn one known bug into a query for its whole pattern family - Sort look-alike findings into real matches and false ones ## Information **Variant Analysis at a glance** | | | | --- | --- | | Kind | Skill | | Publisher | [Trail of Bits](/@trailofbits) | | Category | [Security](/category/security) | | Works with | Agent Skills - an open standard supported by 40+ agents | | Size | 44 KB | | Licence | CC-BY-SA-4.0 | | Repository | [trailofbits/skills](https://github.com/trailofbits/skills/tree/ea7c60e6283d97f4cae485b1671b3936dc604fcb/plugins/variant-analysis/skills/variant-analysis) | | GitHub stars | 6,823 (as of Nov 2026) | | Installs | 7,098, counted by skills.sh (Nov 2026) | ## Security report **Verified.** AIR scanned this exact version of Variant Analysis and flagged nothing. AIR's verdict: **safe**. **What Variant Analysis's check was run against** | | | | --- | --- | | Commit | ea7c60e6283d97f4cae485b1671b3936dc604fcb | | Content hash | 8ee92a914a02e3d404609e75438c314abbafb3f6f8635277615a163d6f961301 | | Files read | [Browse the files at this exact commit](https://github.com/trailofbits/skills/blob/ea7c60e6283d97f4cae485b1671b3936dc604fcb/plugins/variant-analysis/skills/variant-analysis/SKILL.md) | A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned. [Read the full security report for Variant Analysis](/security/variant-analysis) ## About Variant Analysis Bugs rarely happen once. When a vulnerability, logic error, or bad pattern turns up in a specific file, the next question is where else the same root cause shows up. This is built for that moment, including when you ask it in plain words: are there others like this, is this the same bug. It also works in the other direction, generalizing a single known instance into a CodeQL or Semgrep query covering the whole family of that pattern, and triaging a set of similar-looking candidates against the root cause you already understand. It assumes you have a bug in hand. It is not meant for initial discovery from a blank start. ## What's inside - SKILL.md - instructions - agents/openai.yaml - data - assets/trail-of-bits-mark.svg - template - references/reporting.md - reference - references/root-cause.md - reference - references/searching.md - reference - references/triage.md - reference - resources/codeql/cpp.ql - resources/codeql/go.ql - resources/codeql/java.ql - resources/codeql/javascript.ql - resources/codeql/python.ql - resources/semgrep/cpp.yaml - data - resources/semgrep/go.yaml - data - resources/semgrep/java.yaml - data - resources/semgrep/javascript.yaml - data - resources/semgrep/python.yaml - data - resources/variant-report-template.md - reference ## Questions ### Is Variant Analysis safe to install? AIR scanned this exact version of Variant Analysis and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit ea7c60e6283d, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/variant-analysis. ### How do I install Variant Analysis? Open https://airmarket.ai/app/variant-analysis on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/trailofbits/skills/tree/ea7c60e6283d97f4cae485b1671b3936dc604fcb/plugins/variant-analysis/skills/variant-analysis. Install from that link, not the branch. ## Related on Air Market - [More Security listings](/category/security) - [Everything by Trail of Bits](/@trailofbits) --- Canonical URL: