Mantis skill
19 Google skills to find, reproduce and patch vulnerabilities: from a threat model to a patch and a report, plus an ADK reference harness
- 2,515 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The skills write and run generated reproduction code, which is why the author requires an isolated environment with no access to production systems
- A run sends the contents of reviewed files to the chosen model and spends tokens, with the limit set by parameters
- Fixes are applied to code through shadow copies, and the GitHub Action writes annotations into a pull request
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/mantisDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The skills write and run generated reproduction code, which is why the author requires an isolated environment with no access to production systems
- A run sends the contents of reviewed files to the chosen model and spends tokens, with the limit set by parameters
- Fixes are applied to code through shadow copies, and the GitHub Action writes annotations into a pull request
This is third-party code. Review the repository files before installing.
What it does
Mantis is a set of code security review skills that walks an agent through a pipeline. First `mantis-history` collects past vulnerabilities and fixes from repository history, `mantis-summarize` and `mantis-structural-index` prepare short directory summaries and an index of semantic code units, `mantis-architecture` and `mantis-threat-model` build a knowledge base and a threat model with trust boundaries. Then `mantis-plan` drafts a review plan, `mantis-researcher` audits files by the plan, and `mantis-dedupe`, `mantis-review` and `mantis-critic` remove duplicates, false positives and findings that cannot trigger in a production build. Confirmed findings go through reproduction: `mantis-reproduce` writes and runs a proof that checks the bug in an isolated environment. Its depth depends on the setup, from a static guess to a unit test or a mock server. `mantis-chain` checks whether several weak bugs combine into a more serious one, `mantis-patch` prepares a minimal fix in a shadow copy and verifies it with a repeat attack, `mantis-calibrate` assigns the final score by a rubric against severity inflation, `mantis-report` compiles a packet for people, and `mantis-reflect` records the loop's lessons. During development `mantis-advise` warns when an edit repeats earlier mistakes. The `reference` folder holds a working Google ADK harness: after `./install.sh` and configuration, `./run.sh path/to/code` starts a campaign on a file or directory, with `--focus`, `--exclude`, `--max-tokens` and `--parallel`. A separate GitHub Action audits files changed in a pull request and shows the verdict as annotations. By default it only advises, and blocking merges is switched on with the `fail-on` input.
Who it is for. For security engineers and developers who review the code of their own projects or products they are authorized to test and are ready to triage findings by hand.
Good fit when
- You want a deep security review of a repository with a threat model, a plan and a report for stakeholders
- You want an advisory review of the files changed in a pull request with annotations and, if desired, a block through `fail-on`
- Findings should be confirmed by reproduction in an isolated environment and the fix checked with a repeat attack
- Before an edit you want to ask the accumulated knowledge base whether the code repeats old vulnerabilities (`mantis-advise`)
- You want to build your own harness around the skills and shift the review domain, for example to infrastructure as code or RTL
Not a fit when
- You need a product for production use: the project is for demonstration, is not officially supported by Google and is not eligible for the vulnerability rewards program
- There is no isolated machine: the author requires running the suite only in restricted environments with no access to production systems, sensitive data and internal networks
- You cannot spend tokens without control: long campaigns are expensive, so set `--max-tokens` and `--parallel` in advance
- You have no permission to test the target code and systems: the suite writes and runs code to confirm bugs
Example request
Run mantis-plan for this repository and draft a security review plan from the threat model, then audit the highest-priority filesLimitations
The author opens the README with a warning: the suite creates and runs generated code whose behavior is unpredictable and fits only isolated restricted environments. Models are non-deterministic, invent findings and make mistakes in fixes, so a specialist must verify each finding before a report is sent, and mass-filing unverified reports to open-source maintainers is unacceptable. A failed reproduction does not prove a false positive, and a successful one does not guarantee exploitation in any condition.
It is a dual-use tool: use it only against systems and data you are authorized to test. Running it needs Docker, optionally gVisor with the network off for reproduction code, and access to a model: through litellm Gemini API, Vertex AI, Anthropic and compatible endpoints work, with keys in environment variables. The project calls itself a demonstration and does not recommend it for production. Apache-2.0 license.
How to disable. Remove the `mantis-*` skills from the agent's skills folder and delete the `workspace` folder with campaign results. The GitHub Action is turned off by deleting `.github/workflows/mantis-pr-scan.yml` or the step that uses it in your workflow.
FAQ
How is the pipeline built and can stages run separately?
The suite is modular: stages read and write shared state on disk in the `workspace` folder, so they can run sequentially or in parallel. The order is history, index and summaries, architecture and threat model, plan, research, merging and checking of findings, reproduction, chains, patching, calibration, report and lessons.
How does a target snapshot differ from a live folder?
By default the pipeline reviews one static snapshot. With the opt-in `--sync` mode each pass pins its own immutable copy of the target, findings are stamped with the snapshot and syncing happens only between passes and non-destructively.
Where does my code go?
Files the researcher reads go into requests to the chosen model, and the provider address and keys are set in the environment. In the GitHub Action the `api-base` input can point to a compatible endpoint on your own server. GCE cloud sandboxes are covered in a separate guide, `reference/docs/gce_sandbox_setup.md`.
What does the GitHub Action do in a pull request?
It checks only changed files, caps model calls per file (150 by default) and token spend per run, and prints the verdict as diff annotations and in the step summary. The default model is `gemini-3.8-flash`, others are set with the `model` input.
How can the suite be adapted to another domain?
The author lists options: RTL review in SystemVerilog and VHDL, infrastructure as code with Terraform and Kubernetes, data and machine learning pipelines, gray-box review of firmware and binaries, and swapping the reproduction environment for virtual machines or test benches. The `mantis-pipeline-adapter` skill guides you through building your own harness.
Discussion
No questions or reviews yet.
Related
SkillsAgentic SAST scanner: AI agents read your code, confirm findings through the call graph and scan a whole repository or a diff for pull request review
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Anthropic's reference set for defending code: threat-model, vuln-scan, triage and patch skills in Claude Code plus an autonomous vulnerability pipeline
The Snyk CLI for finding vulnerabilities in code, dependencies, containers and IaC, with a built-in MCP server and agent mode
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Agentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Mantis (this entry) | yes | 2,515 | |
| security-audit | no | 39,716 | Cloudflare's six-phase security audit skill with independent verification, without reproduction, patches or a harness |
| Claude Code Security Reviewer | no | 6,490 | Anthropic's GitHub Action that checks pull request changes with Claude and leaves comments |
| LLM SAST Skills | no | 1,345 | a three-step static analysis method without running code or reproducing bugs |
README in short
The description opens with two warnings: about isolation and about responsible use of results. It then gives the harness launch steps, the list of tasks the suite covers and a note that this is a starting point to adapt to your organization. A separate file for agents describes the pipeline architecture, contracts between stages, the snapshot model and adaptation to other domains. The repository holds a Python reference harness with sandboxes, a GitHub Action, a contribution guide and data schemas.
README badge
Original SKILL.md
---
name: mantis-advise
description: >-
Proactive security advisor and architectural remediation assistant for secure code development.
Use to query threat models, historical vulnerability lineages, verified patch patterns, triaged false positives, and learned trajectory invariants before code edits or to generate architectural remediation plans for confirmed findings.
Don't use for automated multi-pass red-team exploitation or fuzzing.
---
# Security Advisor & Remediation Engine (/mantis-advise)
## System Goal
Proactive Secure Development & Architectural Remediation Engine. Functions as a
security guardrail, advisory assistant, and architectural remediator for
developers and coding agents. Queries Mantis threat models, historical
vulnerability lineages, verified remediation patterns, triaged false positives,
and learned trajectory invariants to ensure that new code and refactors are
implemented securely from the start, and to synthesize robust architectural
remediations for confirmed vulnerabilities.
## Command Definition
- **Command:** `/mantis-advise`
- **Description:** Queries security knowledge for a given target file or module,
evaluates proposed changes against known threat boundaries, and provides
verified secure implementation guidance or architectural remediation plans.
- **Execution Command:**
```bash
python3 "${MANTIS_HOME:-/path/to/mantis}/reference/scripts/advise.py" --file <target_file> [--db knowledge.db]
```
- **Arguments (optional):**
- `--file` / `-f` (or `--target` / `-t`): Target source file or component path
(e.g. `src/auth.py` or `api/app.py`). Defaults to repo-wide scope if
omitted.
- `--remediate` / `-r`: Finding ID, lineage UUID, or file to generate an
architectural remediation dossier and verification plan for.
- `--db` / `-d`: Path to Mantis SQLite database (default: auto-discovers
`knowledge.db` or `workspace/knowledge.db`).
- `--lineage` / `-l`: Query lifecycle and recurrence for a specific lineage
UUID.
- `--signature` / `-s`: Query lifecycle for a specific content signature hash.
- `--json`: Emit structured JSON output instead of formatted markdown.
- `--full`: Emit unabridged OKF markdown bodies and un-truncated diffs.
## How to Fetch Guidance
All Mantis knowledge (threat models, historical findings, verified patches,
triaged false positives, and learned invariants) lives in the SQLite database
(`knowledge.db`). Do not look for flat files on disk (like `learnings.jsonl` or
`workspace/findings/*.json`). Use one of the two execution doors below: