القائمة
Given a confirmed finding, search the whole target/ for semantically similar bugs. Applies the trailofbits variant-analysis approach — one root cause usually breeds siblings.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | variant-analysis |
| description | Given a confirmed finding, search the whole target/ for semantically similar bugs. Applies the trailofbits variant-analysis approach — one root cause usually breeds siblings. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/variant-analysis |
Most real audits discover a bug once and miss its five siblings. Variant analysis closes that gap systematically.
For each HIGH/MEDIUM finding:
child_process.exec(req.body.cmd). Shape:
"user-controlled input flows into an exec-family call without escaping."semgrep-rule-creator).reports/variants/<finding-id>.sarif.subprocess.run(..., shell=True) vs. os.system vs.
commands.getoutput), add each to the rule and re-run.Initial finding:
# target/app/handlers.py:42
subprocess.call(request.form['cmd'], shell=True) # CMD-INJECTION
Shape:
request.form[*], request.args[*], request.json[*]subprocess.(call|run|Popen|check_output) with shell=True OR
os.system(*) OR os.popen(*) OR commands.getoutput(*)Run the taint rule. Possible variants found:
handlers.py:88 — same pattern via os.systemadmin/utils.py:14 — helper run_cmd(s) called from 7 sites with user-supplied sworker.py:120 — same pattern but sanitised by shlex.quote — not a bugAppend to reports/findings.json:
variants array inside the parent finding listing all call sites, ORmetadata.parent_id pointing to the original.Ensure reports/SUMMARY.md links every HIGH finding to its variant list.