Trailmark Variant Neighborhood

Expand one seed issue into graph-derived variant candidates. This skill generates review targets, not confirmed findings.

When to Use

• A finding is confirmed or plausible and variants may exist
• The vulnerable pattern depends on call context
• The issue involves a shared sink, source, validator, interface, override, trait, hook, handler, adapter, or critical type
• The next step is to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review

When NOT to Use

• No seed issue exists. Use discovery or triage first.
• The pattern is purely syntactic and already obvious. Use semgrep-rule-creator directly.
• The question is exploit-chain composition across multiple findings. Use a composition workflow.
• The goal is remediation verification. Use a remediation-review workflow.
• The seed cannot be bound to a graph node.

Rationalizations to Reject

Rationalization	Why It Is Wrong	Required Action
"Nearby code means variant"	Proximity is only a candidate reason	Rank it as a review target
"Only exact same names matter"	Variants often share sinks or preconditions, not names	Expand across callers, callees, interfaces, and types
"Every candidate is a finding"	This skill outputs candidates for review	Avoid vulnerability claims
"Unreachable candidates can be ignored completely"	They may become reachable after refactors	Rank lower or list as deferred
"Graph candidates replace semantic pattern work"	Graph structure finds locations, not root-cause semantics	Hand off to variant-analysis, Semgrep, CodeQL, or manual review

Workflow

Variant Neighborhood Progress:
- [ ] Step 1: Normalize and bind the seed
- [ ] Step 2: Expand graph neighborhoods
- [ ] Step 3: Rank candidates
- [ ] Step 4: Extract variant pattern guidance
- [ ] Step 5: Emit handoff packet

Step 1: Normalize And Bind The Seed