deonmenezesCommunity·13 Agent Skills Included

mantishack

Autonomous vulnerability discovery, validation, and remediation pipeline

Runs a staged security pipeline that scans codebases with SAST, dependency, and secrets scanners, then validates each finding through attacker-simulation and reachability proofs. Eliminates false-positive noise by rejecting unproven candidates with cited roadblocks and tracking every finding in a tool-owned lifecycle. Chains confirmed issues, generates gated exploit proofs, proposes fixes, and produces graded reports automatically.

482|72

↗

npx skills add deonmenezes/mantishack --all -g -y

Available:

Gives the AI agent strict Rust coding, testing, sandbox, and code-review rules to follow whenever it modifies or reviews code in this repository.

All Skills in This Repository (13)

Pure Emerald Level Indicators

📦 In Repo

deonmenezes

code-understanding

Map architecture, trace data flows, and hunt vulnerability variants in code.

redteam-hunting

Rotate attack angles across rounds to exhaust codebase vulnerability findings.

tamper-fuzzing

Enumerate reachable input units and mutate them through a tamper matrix.

exploitability-validation

Validate vulnerability findings for real, reachable exploitability across pipeline stages.

github-archive

Query GitHub Archive data in BigQuery to extract forensic evidence for security investigations.

github-commit-recovery

Recover deleted or orphaned GitHub commits with content, diffs, and metadata.

github-evidence-kit

Collect and verify forensic evidence from GitHub API, GH Archive, and local Git sources.

oss-forensics-orchestration

Orchestrate multi-agent OSS forensics investigations with evidence collection and reporting.

github-wayback-recovery

Retrieve deleted GitHub content from Wayback Machine via CDX queries.

Code Coverage with gcov

Instrument C/C++ projects with gcov to generate coverage reports.

Function Call Tracing

Trace C/C++ program function calls into per-thread logs and Perfetto JSON via -finstrument-functions.

rr-debugger

Record and replay native binaries with rr for deterministic reverse debugging.

Community

Advanced

Frequently Asked Questions

FAQPage Schema

How to install Mantishack?▼

Run `npx skills add deonmenezes/mantishack --all -g -y` in your terminal to install all skills in this suite globally.

How does Mantishack find vulnerabilities?▼

It runs scanners like Semgrep, CodeQL, osv-scanner, and trufflehog to surface candidates, then uses attacker-simulation and z3 reachability checks to confirm only real, exploitable issues.

Does Mantishack reduce false positives?▼

Yes. Every candidate must include reachability evidence to be confirmed, and rejections must cite a specific roadblock such as an auth gate or sanitizer.

Is Mantishack safe to run on any codebase?▼

It is designed for authorized testing only, defaults to read-only static analysis, and keeps exploitation gated off unless you explicitly enable it.

What scanners do I need installed for Mantishack?▼

Core features work out of the box, while optional scanners like semgrep, bandit, trivy, trufflehog, and z3 unlock deeper coverage once installed.