googleOfficial·21 Agent Skills Included

mantis

Automated security review pipeline that finds, verifies, and patches vulnerabilities

Runs a full AI-driven security review pipeline: maps codebases, builds threat models, audits source files, and filters false positives. Reproduces confirmed bugs in isolated sandboxes, chains exploits, generates verified patches, and scores risk automatically. Eliminates manual audit toil while keeping every finding traceable, deduplicated, and ready for human expert review.

865|94

↗

npx skills add google/mantis --all -g -y

Available:

Gives AI agents working in this repository strict rules for formatting, keeping shared instruction blocks identical across skills, and safely extracting reference files without breaking security invariants.

All Skills in This Repository (21)

Pure Emerald Level Indicators

📦 In Repo

google

mantis-reproduce

Generate and execute crash reproduction scripts in isolated sandbox environments.

mantis-report

Synthesize security finding logs and exploit chains into structured markdown review documentation.

mantis-review

Validate security findings against source code snapshots to filter false positives.

mantis-architecture

Synthesize codebase learnings into an interlinked Markdown Knowledge Base.

mantis-chain

Analyze validated finding JSON files to construct multi-step exploit chains.

mantis-history

Analyze VCS commit logs and diffs to extract past vulnerabilities and security fixes.

mantis-critic

Assess production viability of security findings by verifying code reachability in optimized release builds.

mantis-pipeline-adapter

Design deterministic orchestrator harnesses for security review pipelines.

mantis-researcher

Perform triage and deep-dive security reviews of source code files.

mantis-summarize

Generate security-focused directory summaries via bottom-up repository traversal.

mantis-dedupe

Merge redundant security findings into unique records with audit history.

mantis-structural-index

Build a content-addressed semantic-unit index of symbols, call edges, and function boundaries from source code.

Official

Advanced

Frequently Asked Questions

FAQPage Schema

How to install Mantis?▼

Run `npx skills add google/mantis --all -g -y` in your terminal to install the full skill suite globally.

What does Mantis do?▼

Mantis is a set of AI agent skills that run an end-to-end security review: auditing code, verifying findings, reproducing crashes in sandboxes, generating patches, and producing a final risk report.

Is Mantis safe to run on my own code?▼

Only run it in isolated environments such as containers or dedicated VMs, because it executes AI-generated reproducer code. All findings must be manually verified by a security expert before being reported or applied.

Which AI agents work with Mantis?▼

Mantis is platform agnostic and works with any coding agent framework that supports the SKILL.md standard, including Gemini CLI, Antigravity, and Google ADK-based harnesses.

Can Mantis scan binaries or firmware without source code?▼

Yes. The pipeline is target-agnostic and can analyze compiled binaries, firmware blobs, or live endpoints using tools like QEMU, Ghidra, or radare2 instead of source-level review.