Agent skill

Variants

by alpha-omega-security in alpha-omega-security/scrutineer

Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

MITAuto-check: notesDevelopment

Install Variants

skills CLI

$ npx skills add alpha-omega-security/scrutineer --skill variants -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install alpha-omega-security/scrutineer variants --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/alpha-omega-security/scrutineer.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/variants .claude/skills/variants && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "variants" agent skill from https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants into .claude/skills/variants/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "variants", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add alpha-omega-security/scrutineer --skill variants -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install alpha-omega-security/scrutineer variants --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/alpha-omega-security/scrutineer.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/variants .agents/skills/variants && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "variants" agent skill from https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants into .agents/skills/variants/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "variants", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add alpha-omega-security/scrutineer --skill variants -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install alpha-omega-security/scrutineer variants --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/alpha-omega-security/scrutineer.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/variants .cursor/skills/variants && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "variants" agent skill from https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants into .cursor/skills/variants/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "variants", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/alpha-omega-security/scrutineer.git --path skills/variants

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add alpha-omega-security/scrutineer --skill variants -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install alpha-omega-security/scrutineer variants --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/alpha-omega-security/scrutineer.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/variants .gemini/skills/variants && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "variants" agent skill from https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants into .gemini/skills/variants/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "variants", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install alpha-omega-security/scrutineer variants

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add alpha-omega-security/scrutineer --skill variants -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/alpha-omega-security/scrutineer.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/variants .github/skills/variants && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "variants" agent skill from https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants into .github/skills/variants/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "variants", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add alpha-omega-security/scrutineer --skill variants -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install alpha-omega-security/scrutineer variants --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/alpha-omega-security/scrutineer.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/variants .opencode/skills/variants && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "variants" agent skill from https://github.com/alpha-omega-security/scrutineer/tree/main/skills/variants into .opencode/skills/variants/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "variants", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: variants
GitHub stars: 231
Token cost: ~1.2k tokens
SKILL.md length: 588 words
Files: 2
Skills in repo: 48
Repo updated: Oct 8, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

Works in 4 steps: Identify the root cause, not merely its… → Identify the required… → Identify the missing or insufficient… → …
Tasks that involve Root cause analysis
SKILL.md covers Workspace and source finding, Define the variant hypothesis, Validate every candidate and Reporting
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Variants is an agent skill from alpha-omega-security/scrutineer. Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `schema.json`). Compatibility notes: Finding-scoped, static, and read-only. Needs ./src plus the Scrutineer API to read the source finding and existing findings in this repository. Does not…

It sits in Development, covering Root cause analysis. It works with Git. The repository describes itself as: Security through scrutiny. The licence is MIT.

When your agent uses it

Tasks that involve Root cause analysis

Example prompts

“/variants”

Requirements

Compatibility (from SKILL.md): Finding-scoped, static, and read-only. Needs ./src plus the Scrutineer API to read the source finding and existing findings in this repository. Does not inspect dependents or use network sources.
Pre-approved tools (allowed-tools): Read, Write, Bash, Grep, Glob

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

Identify the root cause, not merely its CWE label.
Identify the required attacker-controlled input, data flow, and sink.
Identify the missing or insufficient control.
Identify exclusions: trusted callers, already-guarded paths, tests,

What it can do on your machine

Read from SKILL.md and the folder at commit cce10ee. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
- Read
- Write
- Bash
- Grep
- Glob
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Finding-scoped, static, and read-only. Needs ./src plus the Scrutineer API to read the source finding and existing findings in this repository. Does not inspect dependents or use network sources.
From compatibility in the SKILL.md frontmatter.

Context cost

Variants loads about 1.2k tokens when it runs. Until then it costs about 44 tokens; SKILL.md has 588 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~44
When it runs · the whole SKILL.md, loaded when a task matches: ~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
```
allowed-tools: Read, Write, Bash, Grep, Glob
```

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from alpha-omega-security/scrutineer at commit cce10ee, republished under its MIT licence (© alpha-omega-security). 588 words, ~1,236 tokens.

Download SKILL.mdSave it as .claude/skills/variants/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.

name: variants
description: Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.
allowed-tools: Read, Write, Bash, Grep, Glob
compatibility: Finding-scoped, static, and read-only. Needs ./src plus the Scrutineer API to read the source finding and existing findings in this repository. Does not inspect dependents or use network sources.
license: MIT
metadata.scrutineer.version: 1
metadata.scrutineer.output_file: report.json
metadata.scrutineer.output_kind: findings
metadata.scrutineer.max_turns: 32
metadata.scrutineer.model: high
metadata.scrutineer.min_confidence: high

variants

Starting from one confirmed finding, look for distinct, currently reachable instances of the same root cause in this repository. This is a narrow finding-scoped review, not a second full audit. It covers the source repository only; dependent and downstream variants belong to a separate exposure review.

Emit only high-confidence, independently actionable siblings. An empty report is a successful and useful result.

Workspace and source finding

./src is the repository at the scan commit.
./context.json contains the scrutineer API details and finding_id.
./report.json is the required output and must conform to schema.json.

Read context.json first. If scrutineer.finding_id, api_base, or token is missing, write {"findings":[]} and exit successfully.

Fetch the source finding:

GET {api_base}/findings/{finding_id}
Authorization: Bearer {token}

Then fetch the repository's existing findings:

GET {api_base}/repositories/{repository_id}/findings
Authorization: Bearer {token}

If either request fails, write an empty report rather than guessing. If the source finding is rejected, duplicate, fixed, or published, write {"findings":[]} and exit successfully.

Define the variant hypothesis

Turn the source finding into a precise hypothesis before searching:

Identify the root cause, not merely its CWE label.
Identify the required attacker-controlled input, data flow, and sink.
Identify the missing or insufficient control.
Identify exclusions: trusted callers, already-guarded paths, tests, generated code, vendored code, fixtures, unreachable helpers, and changes that are no longer present at HEAD.

Use rg, git grep, and focused file reads to find structural siblings: shared helpers, equivalent parser branches, alternate protocol handlers, or other callers that reach the same risky primitive. Use git log -S, git blame, and git show when history is needed to distinguish a current bug from a fixed historical pattern. Historical code is not a finding.

Do not broaden the task into an unrelated audit. A similar-looking API, a matching CWE, or a string match alone is not a variant.

Show full SKILL.md (288 more words)Show less

Validate every candidate

For each candidate, establish all of the following before reporting it:

Distinctness: It is not the source location and does not duplicate an existing repository finding's root cause and affected location.
Reachability: Trace the relevant trust boundary through the candidate to the security-sensitive operation.
Missing control: Check the exact candidate path for the mitigation that protects the source location. Do not report a sibling protected by a different guard.
Currentness: Confirm the code is present in ./src and exclude documentation, tests, fixtures, generated code, vendored code, and dead branches unless production reachability is demonstrated.
Impact: Explain why the candidate has the same or a separately actionable security impact. Do not inherit severity without checking the candidate's own preconditions.

Remain static and read-only: do not build, execute, install, modify, commit, or send data outside the local repository and the Scrutineer API reads above. Record the searches, inspected code paths, and mitigation checks in validation.

Reporting

Use one finding for each independently exploitable root cause. You may use locations only when one remediation genuinely covers every listed location.

Every emitted finding must:

use confidence: "high" and discovered_via: "source";
have a title beginning Variant of finding #<id>:;
include the source finding in prior_art, for example Variant analysis of finding #42 (archive extraction traversal).;
contain a concrete trace, boundary, validation record, and severity rating;
use repository-relative locations in path:line form.

Do not report:

the original finding;
an existing finding describing the same affected location and root cause;
theoretical patterns without a verified attacker-controlled path to a sink;
low-confidence leads, generic hardening suggestions, or code-quality issues.

Write {"findings":[]} when no candidate meets every requirement. Never write to the source finding or any other Scrutineer record.

Files

SKILL.md and 1 other file in skills/variants of alpha-omega-security/scrutineer.

SKILL.md
schema.json

Open the folder on GitHubat commit cce10ee

Compare with similar skills

Variants next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Variants compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Variants this skillalpha-omega-security/scrutineer	231	—	~1.2k	Automated safety check: Notes	MIT	today
Code Design Rationale Investigatorcursor/plugins	10k	9 repos	~2.6k	Automated safety check: Pass	None	today
Debugging and Error Recoveryaddyosmani/agent-skills	103k	1 repos	~2.6k	Automated safety check: Pass	MIT	4 days ago
Root Cause Tracingsandgardenhq/sgai	137	4 repos	~1.4k	Automated safety check: Pass	Custom licence	17 days ago
Codexqa Rootcause Analyzeropenqa-cn/codexqa	152	—	~2.6k	Automated safety check: Pass	Apache-2.0	5 days ago
Investigate Issueanalogjs/analog	3.2k	—	~2k	Automated safety check: Pass	MIT	today

Similar skills

Code Design Rationale Investigator
cursor/plugins
Official
Digs into why code is shaped the way it is by checking git history, pull requests and connected tools in parallel, then reporting a cited read on the tradeoffs.
10k GitHub starsUsed in 9 repos~2.6k tokens
DevelopmentAuto-check passed
Debugging and Error Recovery
addyosmani/agent-skills
Applies a stop-the-line rule and a step-by-step triage when tests fail, builds break or something stops working, aiming at the root cause instead of guesses.
103k GitHub starsUsed in 1 repo~2.6k tokens
DevelopmentAuto-check passed
Root Cause Tracing
sandgardenhq/sgai
A skill your agent uses when errors occur deep in execution and you need to trace back to find the original trigger - systematically traces bugs backward through call stack, adding instrumentation…
137 GitHub starsUsed in 4 repos~1.4k tokens
DevelopmentAuto-check passed
Codexqa Rootcause Analyzer
openqa-cn/codexqa
Diagnoses exception root causes from stack traces, logs, call-chain dumps, and debug output using the CodexQA CLI for structured repo analysis.
152 GitHub stars~2.6k tokensUpdated 5 days ago
DevelopmentAuto-check passed
Investigate Issue
analogjs/analog
Investigate a GitHub issue end to end — reproduce the reporter's repo or code snippet in an isolated sandbox outside the monorepo, trace the root cause in the source, and draft a reply back to the…
3.2k GitHub stars~2k tokensUpdated today
DevelopmentAuto-check passed
Debug
gnomeria/usbtree
Systematic root-cause debugging — reproduce, isolate, fix at the source, prove the fix.
690 GitHub stars~715 tokensUpdated 1 mo ago
DevelopmentAuto-check passed

More from alpha-omega-security/scrutineer

All 48 skills in this repo

Triage
alpha-omega-security/scrutineer
Default pipeline scrutineer runs when a repository is added.
231 GitHub stars~2.9k tokensUpdated today
Auto-check passed
Zizmor
alpha-omega-security/scrutineer
Audit GitHub Actions workflows with zizmor and explain reported hits using bundled trust-boundary references.
231 GitHub stars~1.2k tokensUpdated today
Auto-check passed
Bandit
alpha-omega-security/scrutineer
Run bandit against the Python source in the repository and map its hits into the findings shape.
231 GitHub stars~615 tokensUpdated today
Auto-check: notes
Compliance
alpha-omega-security/scrutineer
Audit the repository against the OpenSSF Baseline with darnit, resolve the controls darnit defers to LLM analysis or could not verify, and record per-control verdicts plus the attained Baseline level.
231 GitHub stars~1.4k tokensUpdated today
Auto-check: notes
Dependencies
alpha-omega-security/scrutineer
Run git-pkgs list and sbom against the repository and emit one envelope with per-section status.
231 GitHub stars~596 tokensUpdated today
Auto-check passed
History
alpha-omega-security/scrutineer
Mine repository history for security fixes that were never published as advisories, producing a cached worklist for threat-model and advisory-deep-dive.
231 GitHub stars~2.9k tokensUpdated today
Auto-check: notes

Works with

Questions about Variants

What does Variants do?

Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings. Variants is an agent skill from alpha-omega-security/scrutineer. Starting from one confirmed finding, search this repository's current source for distinct sibling instances of the same root cause and emit only validated new findings.

When should I use Variants?

Variants fits situations like: tasks that involve Root cause analysis.

How do I install Variants in Claude Code?

Run `npx skills add alpha-omega-security/scrutineer --skill variants -a claude-code`. Or copy the skill folder (skills/variants in alpha-omega-security/scrutineer) into .claude/skills/variants in your project. Claude Code loads it when a task matches its description.

How do I install Variants in Codex?

Run `npx skills add alpha-omega-security/scrutineer --skill variants -a codex`. Or copy the skill folder (skills/variants in alpha-omega-security/scrutineer) into .agents/skills/variants in your project. Codex loads it when a task matches its description.

Can I use Variants in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add alpha-omega-security/scrutineer --skill variants -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/variants, .gemini/skills/variants, .github/skills/variants and .opencode/skills/variants in your project.

What does Variants need to run?

SKILL.md names no scripts, command-line tools or credentials: Variants is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Write, Bash, Grep, Glob. Compatibility (from SKILL.md): Finding-scoped, static, and read-only. Needs ./src plus the Scrutineer API to read the source finding and existing findings in this repository. Does not inspect dependents or use network sources..

Does Variants access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Variants safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Variants use?

Variants is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Variants use?

About 1.2k tokens (SKILL.md is roughly 4.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Variants?

Skills that share tags, products or a category with Variants: Code Design Rationale Investigator (cursor/plugins, 10k stars), Debugging and Error Recovery (addyosmani/agent-skills, 103k stars), Root Cause Tracing (sandgardenhq/sgai, 137 stars) and Codexqa Rootcause Analyzer (openqa-cn/codexqa, 152 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Variants?

alpha-omega-security (a GitHub organization) maintains it in alpha-omega-security/scrutineer, which has 231 GitHub stars. The repository holds 48 skills in this directory. The repository was last updated on October 8, 2026.

Source: alpha-omega-security/scrutineer on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Variants

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Compatibility

Context cost

Safety

SKILL.md

variants

Workspace and source finding

Define the variant hypothesis

Validate every candidate

Reporting

Files

Compare with similar skills

Similar skills

More from alpha-omega-security/scrutineer

Related

Questions about Variants