Borrowing it
Nothing to install: this file belongs to mtarcure/claude-vibe-squad. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mtarcure/claude-vibe-squad/main/.agents/skills/variant-analysis/SKILL.mdgit clone --depth 1 https://github.com/mtarcure/claude-vibe-squadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mtarcure/claude-vibe-squad/variant-analysis)<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/variant-analysis"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/variant-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/variant-analysis"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/variant-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00498 |
| Opus 5 | $0.00028 | $0.00249 |
| Sonnet 5 | $0.00011 | $0.00100 |
| Haiku 4.5 | $0.00006 | $0.00050 |
Grade A, and why
variant-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 28 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Variant Analysis
After one defect is confirmed, find every sibling of it in the codebase before closing the issue — the first instance is rarely the only one.
Steps
- Characterize the root cause precisely: the unsafe primitive, the missing check, and the condition that makes it exploitable. A vague characterization finds nothing.
- Decide the variant axes to sweep: same primitive elsewhere, same call site with a different input source, same missing check in sibling handlers, and the same idiom in other languages or services in the repo.
- Search structurally, not textually. Encode the pattern as a Semgrep rule via
semgrep-rule-authoror an AST query; grep misses reformatted and refactored instances, which are the ones that survive. - Sweep history as well as the working tree: the same defect frequently exists in a copied file, a vendored fork, or a branch that was never merged back.
- For each candidate hit, run the reachability and impact gates from
findings-filter— a variant is only a finding if it is independently reachable. - Group confirmed variants under the single root cause and propose one structural fix, such as a safe wrapper or a type that makes the unsafe state unrepresentable, rather than N local patches.
- Where a local patch is unavoidable, add the rule to the repo's static-analysis config so future instances are caught at review time.
- Record the sweep's coverage explicitly: which axes were swept, which paths were excluded, and what would still be missed. An unbounded "we looked" claim is not coverage.
Acceptance
- The root cause is stated as primitive + missing check + exploitability condition.
- The sweep is structural (rule or AST query), with the query recorded and re-runnable.
- Vendored, copied, and historical instances were searched, not just the working tree.
- Each variant passed reachability and impact gates independently.
- A single structural fix is proposed where possible, and a detection rule is added to prevent regression.
- Sweep coverage and known gaps are stated explicitly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 28 lines · 57 tokens per session scan A 33a1f37ac6e1
variant-analysis is a skill published in the GitHub repository mtarcure/claude-vibe-squad (122 stars, last pushed today), licensed MIT. It adds 57 tokens to every session and 498 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rust-check
Run cargo check on the current Rust project to find compile errors.
debug
Reproduce, minimize, localize, identify root cause, and distinguish diagnosis from an authorized fix. Prefer root-cause over symptom patches.
openrig-skills
Use when you're operating OpenRig and need the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also use when you don't…
diagnose-skill-run
Diagnose a failed or suspicious Runx skill execution from receipts and harness evidence, then propose the smallest bounded improvement without replaying the failed operation.
postmortem-maker
Turn resolved-incident fragments into a traceable postmortem that separates fragment-cited facts from hypotheses, blocks publication while unknowns remain, and keeps the comms send behind a human gate.
oversight-team
Use when you are a seat on the oversight pod (a standing monitor-mode rig that keeps OTHER rigs healthy), configuring or running the drift detectors, or choosing whether to intervene vs escalate. Covers the pull-not-poll posture, the v0 detectors (premature-park, process-drift, off-task, token-burn), the intervention…