[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M699125ACYC4BKTFFCP476VM":3,"skill-same:01M699125ACYC4BKTFFCP476VM":68},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":47,"repositoryHtmlUrl":48,"repositoryHomepageUrl":49,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M699125ACYC4BKTFFCP476VM","mantis-advise",null,"Proactive security advisor and architectural remediation assistant for secure code development. Use to query threat models, historical vulnerability lineages, verified patch patterns, triaged false positives, and learned trajectory invariants before code edits or to generate architectural remediation plans for confirmed findings. Don't use for automated multi-pass red-team exploitation or fuzzing.","google\u002Fmantis","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M6990SDGGFEAP21TJNS7HEG9",2759,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-advise\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"advise","mantis advise","use","for","verified","red","learned","false","query","models","patch","assistant","team","vulnerability","exploitation","code","generate","secure","fuzzing","security","2026-11-10 10:12:30",false,"---\nname: mantis-advise\ndescription: >-\n  Proactive security advisor and architectural remediation assistant for secure code development.\n  Use to query threat models, historical vulnerability lineages, verified patch patterns, triaged false positives, and learned trajectory invariants before code edits or to generate architectural remediation plans for confirmed findings.\n  Don't use for automated multi-pass red-team exploitation or fuzzing.\n---\n\n# Security Advisor & Remediation Engine (\u002Fmantis-advise)\n\n## System Goal\n\nProactive Secure Development & Architectural Remediation Engine. Functions as a\nsecurity guardrail, advisory assistant, and architectural remediator for\ndevelopers and coding agents. Queries Mantis threat models, historical\nvulnerability lineages, verified remediation patterns, triaged false positives,\nand learned trajectory invariants to ensure that new code and refactors are\nimplemented securely from the start, and to synthesize robust architectural\nremediations for confirmed vulnerabilities.\n\n## Command Definition\n\n- **Command:** `\u002Fmantis-advise`\n- **Description:** Queries security knowledge for a given target file or module,\n  evaluates proposed changes against known threat boundaries, and provides\n  verified secure implementation guidance or architectural remediation plans.\n- **Execution Command:**\n  ```bash\n  python3 \"${MANTIS_HOME:-\u002Fpath\u002Fto\u002Fmantis}\u002Freference\u002Fscripts\u002Fadvise.py\" --file \u003Ctarget_file> [--db knowledge.db]\n  ```\n- **Arguments (optional):**\n  - `--file` \u002F `-f` (or `--target` \u002F `-t`): Target source file or component path\n    (e.g. `src\u002Fauth.py` or `api\u002Fapp.py`). Defaults to repo-wide scope if\n    omitted.\n  - `--remediate` \u002F `-r`: Finding ID, lineage UUID, or file to generate an\n    architectural remediation dossier and verification plan for.\n  - `--db` \u002F `-d`: Path to Mantis SQLite database (default: auto-discovers\n    `knowledge.db` or `workspace\u002Fknowledge.db`).\n  - `--lineage` \u002F `-l`: Query lifecycle and recurrence for a specific lineage\n    UUID.\n  - `--signature` \u002F `-s`: Query lifecycle for a specific content signature hash.\n  - `--json`: Emit structured JSON output instead of formatted markdown.\n  - `--full`: Emit unabridged OKF markdown bodies and un-truncated diffs.\n\n## How to Fetch Guidance\n\nAll Mantis knowledge (threat models, historical findings, verified patches,\ntriaged false positives, and learned invariants) lives in the SQLite database\n(`knowledge.db`). Do not look for flat files on disk (like `learnings.jsonl` or\n`workspace\u002Ffindings\u002F*.json`). Use one of the two execution doors below:\n\n### Mechanism 1: CLI Execution (Recommended for Coding Agents)\n\nCoding agents with standard bash access should run `advise.py` using its\ninstallation-anchored absolute path.\n\n**Path Anchoring Requirement (CRITICAL)**: The advisor script resides within the\nMantis installation directory at `reference\u002Fscripts\u002Fadvise.py`. **You MUST\ninvoke this script via an absolute path or via `$MANTIS_HOME`**. NEVER execute\n`python3 reference\u002Fscripts\u002Fadvise.py` using a relative path inside the audited\ntarget repository, as untrusted repositories could spoof scripts or cause\ncommand failures.\n\n1. **Query Security Guidance for Target File**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file src\u002Fauth.py\n   ```\n\n   *Prints*: Actionable security advisory markdown with active threat model,\n   historical vulnerabilities, verified patch diffs, triaged false positives,\n   and invariants.\n\n2. **Query Specific Bug Lineage & Recurrence**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --lineage c3a5e982-1234-5678-9abc-def012345678\n   ```\n\n3. **Machine-Readable JSON**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file src\u002Fauth.py --json\n   ```\n\n4. **Architectural Remediation Dossier for a Finding**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --remediate \u003Cfinding_id>\n   ```\n\n### Mechanism 2: Python Tool Invocation (Inside Pipeline \u002F Harness)\n\nWhen running inside an agent harness or Python environment:\n\n```python\nfrom core.database import query_security_guidance\n\nguidance = query_security_guidance(db_path=\"knowledge.db\", filepath=\"src\u002Fauth.py\")\nprint(guidance[\"guidance_summary\"])\n```\n\nOr via tool helper:\n\n```python\nget_security_guidance(filepath=\"src\u002Fauth.py\")\n```\n\n## Input\u002FOutput Contract\n\n- **Reads**:\n  - `knowledge.db` (`findings`, `campaign_artifacts`, `learnings`, and\n    `risk_scores` tables).\n  - Target source code files (under repository root).\n- **Writes**:\n  - Structured Security Advisory & Guardrail recommendations formatted for the\n    active developer or coding agent.\n\n## Core Advisory Protocols\n\n### Protocol 1: Pre-Implementation Security Context Check\n\nBefore authoring code or refactoring an existing module:\n\n1. **Run the Advisor**: Execute\n   `python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file \u003Ctarget_file>`.\n2. **Review Advisory Context**:\n   - **Trust Boundaries**: Identify who interacts with this module (untrusted\n     public internet, authenticated users, internal microservices).\n   - **Historical Pitfalls**: Review all vulnerabilities previously confirmed or\n     reproduced on this file. Pay specific attention to recurring `lineage_id`\n     chains.\n   - **Verified Safe Idioms**: Review verified patch diffs from prior passes\n     marked `VERIFIED_SECURE`.\n   - **Triaged False Positives**: Review patterns previously classified as false\n     positives to understand intentional design choices and avoid breaking\n     legitimate functionality.\n\n### Protocol 2: Trust Boundary Verification\n\nWhen introducing new endpoints, parameters, data parsing, or subprocess\nexecution:\n\n1. **Input Normalization & Validation**:\n\n   - Never trust input from external boundaries without canonicalization and\n     strict schema enforcement.\n   - For file paths: resolve against jail boundaries using strict\n     `os.path.abspath` or `Path.resolve()` checks (`startswith(jail_dir)`).\n   - For OS command execution: strictly use `shlex.quote` or array-based\n     `subprocess.run([\"cmd\", arg])` without `shell=True`.\n\n2. **Defense-in-Depth**:\n\n   - Ensure server-side validation even if client-side validation is present.\n   - Ensure zero-privilege assumptions (e.g. no unnecessary IAM permissions,\n     bounded execution timeouts).\n\n### Protocol 3: Lineage & Recurrence Defense\n\n1. When fixing a reported vulnerability or refactoring a vulnerable component,\n   check the bug's `lineage_id` via\n   `python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file \u003Ctarget_file>`.\n2. Ensure the new implementation completely closes all attack vectors\n   demonstrated in prior re-attack verification test suites.\n\n### Protocol 4: Architectural Vulnerability Remediation & Sandbox Verification\n\nWhen resolving a confirmed security flaw (in pipeline or standalone):\n\n1. **Grounding Context**:\n\n   - Query\n     `python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --remediate \u003Cfinding_id>`\n     (or `get_security_guidance(filepath=...)`).\n   - Extract active OKF Threat Boundaries and Security Invariants.\n   - Inspect prior verified safe patterns from matching lineage history.\n\n2. **Architectural Synthesis**:\n\n   - Do NOT produce superficial point-hacks (e.g. `return None`, hardcoded\n     `False`, or commenting out endpoints) that lobotomize functionality.\n   - Refactor root-cause sinks using safe idioms (parameterization, strict\n     bounds, array argv, canonicalized paths).\n\n3. **Sandbox Verification (INV-1 & INV-2)**:\n\n   - Apply the unified diff patch to the guest workspace (`apply_patch`).\n   - Run the finding reproducer (`run_sandbox_with_evidence`).\n   - Verify that the attack fails to reach the sink\n     (`reattack_status == \"failed_to_bypass\"`).\n   - Verify that existing functional test suites pass without regression.\n\n## Output Format\n\nThe Advisor outputs clean, actionable recommendations:\n\n````markdown\n# Security Advisory: \u003Ctarget_file>\n\n### 1. Threat Model & Trust Boundaries\n- **Entry Points**: \u003Cuntrusted network \u002F RPC \u002F CLI>\n- **Sensitive Assets**: \u003Ccredentials, filesystem, tenant data>\n\n### 2. Known Pitfalls & Historical Lineages\n- **[CWE-XX] \u003CTitle>** (Lineage: `\u003Cuuid>`): \u003CHow it occurred and how it was resolved>\n- **Verified Safe Pattern**:\n  ```python\n  # Safe implementation idiom\n````\n\n### 3. False Positive Context (Intentional Behavior)\n\n- **\u003CPattern>**:\n  \u003CWhy this pattern is considered safe in this specific architecture>\n\n### 4. Implementation Checklist\n\n- [ ] Validated against path traversal \u002F injection \u002F deserialization.\n- [ ] Adheres to verified patch patterns.\n- [ ] Respects trust boundary isolation.\n\n```\n```\n","# Security Advisor & Remediation Engine (\u002Fmantis-advise)\n\n## System Goal\n\nProactive Secure Development & Architectural Remediation Engine. Functions as a\nsecurity guardrail, advisory assistant, and architectural remediator for\ndevelopers and coding agents. Queries Mantis threat models, historical\nvulnerability lineages, verified remediation patterns, triaged false positives,\nand learned trajectory invariants to ensure that new code and refactors are\nimplemented securely from the start, and to synthesize robust architectural\nremediations for confirmed vulnerabilities.\n\n## Command Definition\n\n- **Command:** `\u002Fmantis-advise`\n- **Description:** Queries security knowledge for a given target file or module,\n  evaluates proposed changes against known threat boundaries, and provides\n  verified secure implementation guidance or architectural remediation plans.\n- **Execution Command:**\n  ```bash\n  python3 \"${MANTIS_HOME:-\u002Fpath\u002Fto\u002Fmantis}\u002Freference\u002Fscripts\u002Fadvise.py\" --file \u003Ctarget_file> [--db knowledge.db]\n  ```\n- **Arguments (optional):**\n  - `--file` \u002F `-f` (or `--target` \u002F `-t`): Target source file or component path\n    (e.g. `src\u002Fauth.py` or `api\u002Fapp.py`). Defaults to repo-wide scope if\n    omitted.\n  - `--remediate` \u002F `-r`: Finding ID, lineage UUID, or file to generate an\n    architectural remediation dossier and verification plan for.\n  - `--db` \u002F `-d`: Path to Mantis SQLite database (default: auto-discovers\n    `knowledge.db` or `workspace\u002Fknowledge.db`).\n  - `--lineage` \u002F `-l`: Query lifecycle and recurrence for a specific lineage\n    UUID.\n  - `--signature` \u002F `-s`: Query lifecycle for a specific content signature hash.\n  - `--json`: Emit structured JSON output instead of formatted markdown.\n  - `--full`: Emit unabridged OKF markdown bodies and un-truncated diffs.\n\n## How to Fetch Guidance\n\nAll Mantis knowledge (threat models, historical findings, verified patches,\ntriaged false positives, and learned invariants) lives in the SQLite database\n(`knowledge.db`). Do not look for flat files on disk (like `learnings.jsonl` or\n`workspace\u002Ffindings\u002F*.json`). Use one of the two execution doors below:\n\n### Mechanism 1: CLI Execution (Recommended for Coding Agents)\n\nCoding agents with standard bash access should run `advise.py` using its\ninstallation-anchored absolute path.\n\n**Path Anchoring Requirement (CRITICAL)**: The advisor script resides within the\nMantis installation directory at `reference\u002Fscripts\u002Fadvise.py`. **You MUST\ninvoke this script via an absolute path or via `$MANTIS_HOME`**. NEVER execute\n`python3 reference\u002Fscripts\u002Fadvise.py` using a relative path inside the audited\ntarget repository, as untrusted repositories could spoof scripts or cause\ncommand failures.\n\n1. **Query Security Guidance for Target File**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file src\u002Fauth.py\n   ```\n\n   *Prints*: Actionable security advisory markdown with active threat model,\n   historical vulnerabilities, verified patch diffs, triaged false positives,\n   and invariants.\n\n2. **Query Specific Bug Lineage & Recurrence**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --lineage c3a5e982-1234-5678-9abc-def012345678\n   ```\n\n3. **Machine-Readable JSON**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file src\u002Fauth.py --json\n   ```\n\n4. **Architectural Remediation Dossier for a Finding**:\n\n   ```bash\n   python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --remediate \u003Cfinding_id>\n   ```\n\n### Mechanism 2: Python Tool Invocation (Inside Pipeline \u002F Harness)\n\nWhen running inside an agent harness or Python environment:\n\n```python\nfrom core.database import query_security_guidance\n\nguidance = query_security_guidance(db_path=\"knowledge.db\", filepath=\"src\u002Fauth.py\")\nprint(guidance[\"guidance_summary\"])\n```\n\nOr via tool helper:\n\n```python\nget_security_guidance(filepath=\"src\u002Fauth.py\")\n```\n\n## Input\u002FOutput Contract\n\n- **Reads**:\n  - `knowledge.db` (`findings`, `campaign_artifacts`, `learnings`, and\n    `risk_scores` tables).\n  - Target source code files (under repository root).\n- **Writes**:\n  - Structured Security Advisory & Guardrail recommendations formatted for the\n    active developer or coding agent.\n\n## Core Advisory Protocols\n\n### Protocol 1: Pre-Implementation Security Context Check\n\nBefore authoring code or refactoring an existing module:\n\n1. **Run the Advisor**: Execute\n   `python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file \u003Ctarget_file>`.\n2. **Review Advisory Context**:\n   - **Trust Boundaries**: Identify who interacts with this module (untrusted\n     public internet, authenticated users, internal microservices).\n   - **Historical Pitfalls**: Review all vulnerabilities previously confirmed or\n     reproduced on this file. Pay specific attention to recurring `lineage_id`\n     chains.\n   - **Verified Safe Idioms**: Review verified patch diffs from prior passes\n     marked `VERIFIED_SECURE`.\n   - **Triaged False Positives**: Review patterns previously classified as false\n     positives to understand intentional design choices and avoid breaking\n     legitimate functionality.\n\n### Protocol 2: Trust Boundary Verification\n\nWhen introducing new endpoints, parameters, data parsing, or subprocess\nexecution:\n\n1. **Input Normalization & Validation**:\n\n   - Never trust input from external boundaries without canonicalization and\n     strict schema enforcement.\n   - For file paths: resolve against jail boundaries using strict\n     `os.path.abspath` or `Path.resolve()` checks (`startswith(jail_dir)`).\n   - For OS command execution: strictly use `shlex.quote` or array-based\n     `subprocess.run([\"cmd\", arg])` without `shell=True`.\n\n2. **Defense-in-Depth**:\n\n   - Ensure server-side validation even if client-side validation is present.\n   - Ensure zero-privilege assumptions (e.g. no unnecessary IAM permissions,\n     bounded execution timeouts).\n\n### Protocol 3: Lineage & Recurrence Defense\n\n1. When fixing a reported vulnerability or refactoring a vulnerable component,\n   check the bug's `lineage_id` via\n   `python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --file \u003Ctarget_file>`.\n2. Ensure the new implementation completely closes all attack vectors\n   demonstrated in prior re-attack verification test suites.\n\n### Protocol 4: Architectural Vulnerability Remediation & Sandbox Verification\n\nWhen resolving a confirmed security flaw (in pipeline or standalone):\n\n1. **Grounding Context**:\n\n   - Query\n     `python3 \"$MANTIS_HOME\u002Freference\u002Fscripts\u002Fadvise.py\" --remediate \u003Cfinding_id>`\n     (or `get_security_guidance(filepath=...)`).\n   - Extract active OKF Threat Boundaries and Security Invariants.\n   - Inspect prior verified safe patterns from matching lineage history.\n\n2. **Architectural Synthesis**:\n\n   - Do NOT produce superficial point-hacks (e.g. `return None`, hardcoded\n     `False`, or commenting out endpoints) that lobotomize functionality.\n   - Refactor root-cause sinks using safe idioms (parameterization, strict\n     bounds, array argv, canonicalized paths).\n\n3. **Sandbox Verification (INV-1 & INV-2)**:\n\n   - Apply the unified diff patch to the guest workspace (`apply_patch`).\n   - Run the finding reproducer (`run_sandbox_with_evidence`).\n   - Verify that the attack fails to reach the sink\n     (`reattack_status == \"failed_to_bypass\"`).\n   - Verify that existing functional test suites pass without regression.\n\n## Output Format\n\nThe Advisor outputs clean, actionable recommendations:\n\n````markdown\n# Security Advisory: \u003Ctarget_file>\n\n### 1. Threat Model & Trust Boundaries\n- **Entry Points**: \u003Cuntrusted network \u002F RPC \u002F CLI>\n- **Sensitive Assets**: \u003Ccredentials, filesystem, tenant data>\n\n### 2. Known Pitfalls & Historical Lineages\n- **[CWE-XX] \u003CTitle>** (Lineage: `\u003Cuuid>`): \u003CHow it occurred and how it was resolved>\n- **Verified Safe Pattern**:\n  ```python\n  # Safe implementation idiom\n````\n\n### 3. False Positive Context (Intentional Behavior)\n\n- **\u003CPattern>**:\n  \u003CWhy this pattern is considered safe in this specific architecture>\n\n### 4. Implementation Checklist\n\n- [ ] Validated against path traversal \u002F injection \u002F deserialization.\n- [ ] Adheres to verified patch patterns.\n- [ ] Respects trust boundary isolation.\n\n```\n```\n",{"name":5,"description":7},"main","f3162c039ecd9c9d5d8bc404dd1373c7ca3152f7","skills\u002Fmantis-advise",235,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis","https:\u002F\u002Fcloud.google.com\u002F","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-10 11:41:46",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add google\u002Fmantis --skill mantis-advise",{"tool":60,"command":61},"bunx","bunx skills add google\u002Fmantis --skill mantis-advise",{"tool":63,"command":64},"pnpm","pnpm dlx skills add google\u002Fmantis --skill mantis-advise","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-advise\u002FSKILL.md",true,[],[69,95,123,150,160,175],{"skillNo":70,"name":71,"nameZh":6,"description":72,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":75,"publishedAt":39},"01M6992XJHHV0R5N8E392EHRW3","mantis-threat-model","Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't use for analyzing source code or extracting raw learnings from JSONL files.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-threat-model\u002FSKILL.md",[],[76,77,78,79,80,34,81,82,83,84,85,86,87,88,89,90,91,92,93,94],"mantis threat model","threat model","model","threat","architecture","analyzing","knowledge","kb","files","surfaces","trust","learnings","knowledge base","as","extracting","reading","jsonl","source","source code",{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":106,"publishedAt":39},"01M6992TR1BPA5HVF13QRM7EP0","mantis-summarize","Pre-processes the repository by generating security-focused summaries (mantis-summary.md) for each directory to make planning and research more efficient. Use when starting a review campaign to map the codebase before threat modeling and planning. Don't use for executing code reviews, writing test scripts, or patching code.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-summarize\u002FSKILL.md",[101],{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[107,108,109,110,111,38,112,34,113,114,115,79,116,117,118,119,120,121,22,122],"summarize","mantis summarize","writing","directory","review","threat modeling","planning","repository","patching","campaign","map","modeling","scripts","make","reviews","when",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":134,"publishedAt":39},"01M6992QB4DVMDR2AGT6BPSE3N","mantis-structural-index","Builds a content-addressed semantic-unit index from source code for structural context. Use when a pinned or live codebase is available and structural cross-reference data would improve research quality. Don't use for findings analysis, patching, or reporting.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-structural-index\u002FSKILL.md",[129],{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[135,136,137,138,34,139,140,141,142,115,143,144,145,21,146,147,148,149,22,122],"mantis structural index","index","structural","research","content","reporting","data","analysis","improve","quality","context","research quality","reference","live","unit",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":39},"01M6992KRP2XYWEMV12P5M4GPE","mantis-review","Independently reviews findings and filters out false positives. Use when consolidated findings need validation against the actual source code. Don't use for reproducing crashes or patching code.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-review\u002FSKILL.md",[],[111,157,34,158,115,21,159,26,121,22,93,94,122],"mantis review","validation","filters",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M6992GKVGJ2NXEJWYFVCN01Q","mantis-researcher","Audits production source code files based on the strategy in workspace\u002Fplan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning, deduplicating, or writing patches.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-researcher\u002FSKILL.md",[],[167,168,109,111,169,34,113,142,170,171,21,84,172,173,121,22,93,174,94,122],"mantis researcher","researcher","static analysis","plan","strategy","deep","you","static",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":39},"01M6992D5WXENF3TW68GM5WPHC","mantis-reproduce","Generates and runs crash reproducers to verify security flaws. Use when viable findings exist and you need to write and execute a script or payload to verify the crash. Don't use for code auditing or patching.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fmantis\u002Fblob\u002Fmain\u002Fskills\u002Fmantis-reproduce\u002FSKILL.md",[],[182,183,38,34,115,184,185,186,21,187,188,189,173,22,122],"mantis reproduce","reproduce","verify","write","execute","crash","payload","script"]