メニュー
Given a confirmed finding, search the whole target/ for semantically similar bugs. Applies the trailofbits variant-analysis approach — one root cause usually breeds siblings.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | variant-analysis |
| description | Given a confirmed finding, search the whole target/ for semantically similar bugs. Applies the trailofbits variant-analysis approach — one root cause usually breeds siblings. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
| source_inspiration | trailofbits/skills/variant-analysis |
Most real audits discover a bug once and miss its five siblings. Variant analysis closes that gap systematically.
For each HIGH/MEDIUM finding:
child_process.exec(req.body.cmd). Shape:
"user-controlled input flows into an exec-family call without escaping."semgrep-rule-creator).reports/variants/<finding-id>.sarif.subprocess.run(..., shell=True) vs. os.system vs.
commands.getoutput), add each to the rule and re-run.Initial finding:
# target/app/handlers.py:42
subprocess.call(request.form['cmd'], shell=True) # CMD-INJECTION
Shape:
request.form[*], request.args[*], request.json[*]subprocess.(call|run|Popen|check_output) with shell=True OR
os.system(*) OR os.popen(*) OR commands.getoutput(*)Run the taint rule. Possible variants found:
handlers.py:88 — same pattern via os.systemadmin/utils.py:14 — helper run_cmd(s) called from 7 sites with user-supplied sworker.py:120 — same pattern but sanitised by shlex.quote — not a bugAppend to reports/findings.json:
variants array inside the parent finding listing all call sites, ORmetadata.parent_id pointing to the original.Ensure reports/SUMMARY.md links every HIGH finding to its variant list.