Trailmark Variant Neighborhood

Expand one seed issue into graph-derived variant candidates. This skill generates review targets, not confirmed findings.

When to Use

A finding is confirmed or plausible and variants may exist
The vulnerable pattern depends on call context
The issue involves a shared sink, source, validator, interface, override, trait, hook, handler, adapter, or critical type
The next step is to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review

When NOT to Use

No seed issue exists. Use discovery or triage first.
The pattern is purely syntactic and already obvious. Use semgrep-rule-creator directly.
The question is exploit-chain composition across multiple findings. Use a composition workflow.
The goal is remediation verification. Use a remediation-review workflow.
The seed cannot be bound to a graph node.

Rationalizations to Reject

Rationalization	Why It Is Wrong	Required Action
"Nearby code means variant"	Proximity is only a candidate reason	Rank it as a review target
"Only exact same names matter"	Variants often share sinks or preconditions, not names	Expand across callers, callees, interfaces, and types
"Every candidate is a finding"	This skill outputs candidates for review	Avoid vulnerability claims
"Unreachable candidates can be ignored completely"	They may become reachable after refactors	Rank lower or list as deferred
"Graph candidates replace semantic pattern work"	Graph structure finds locations, not root-cause semantics	Hand off to variant-analysis, Semgrep, CodeQL, or manual review

Workflow

Variant Neighborhood Progress:
- [ ] Step 1: Normalize and bind the seed
- [ ] Step 2: Expand graph neighborhoods
- [ ] Step 3: Rank candidates
- [ ] Step 4: Extract variant pattern guidance
- [ ] Step 5: Emit handoff packet

Step 1: Normalize And Bind The Seed

Accept finding text, file/line, function name, or output from trailmark-finding-triage. Bind the seed to a Trailmark node and record the root cause in plain language.

If the seed has no concrete graph binding, stop before inventing variants.

Step 2: Expand Neighborhoods

Use the dimensions in references/neighborhood-patterns.md:

shared callers
shared callees and sinks
entrypoint path neighbors
interface, override, trait, and implementation siblings
file or module cluster neighbors
taint or privilege-boundary peers
type and state-reference neighbors

Bound expansion to avoid candidate floods.

Step 3: Rank Candidates

Rank with references/ranking.md. Prioritize entrypoint-reachable, tainted, boundary-adjacent, high-blast-radius, shared sink, same-interface, and close-distance candidates. Penalize test, mock, generated, vendor, unreachable, and trusted-internal-only candidates.

Step 4: Extract Pattern Guidance

Summarize what should be searched for syntactically and what requires semantic review. Identify whether follow-up belongs in:

variant-analysis
semgrep-rule-creator
static-analysis with CodeQL or SARIF-producing tools
manual review

Step 5: Emit Handoff Packet

Use references/output-format.md. Include ranked candidates, inclusion reasons, exclusions, limitations, and the variant-analysis handoff.

Stop Conditions

No graph binding exists
Candidate count is too high and the root cause is underspecified
Trailmark cannot analyze the target language
The seed is only in test, generated, or vendor code and the user did not say that code is in scope

trailmark-variant-neighborhood