Queries a SQLite security knowledge base to provide threat models and verified patch guidance for code edits.
npx skills add https://github.com/google/mantis --skill mantis-advise
Please help me install this Agent Skill. Skill: mantis-advise Source: https://github.com/google/mantis/tree/main/mantis-advise Command: npx skills add https://github.com/google/mantis --skill mantis-advise
Developers and coding agents often repeat past security mistakes because historical vulnerability context is scattered or lost. This Skill surfaces threat models, confirmed vulnerability lineages, verified patch patterns, and triaged false positives from a central SQLite knowledge base before and during code edits, preventing recurrence of known flaws.
src/auth.py to review prior injection findings, verified patch diffs, and intentional design decisions flagged as false positives.Ask the agent to run the mantis-advise security advisor on your target file, for example by requesting a security advisory for src/auth.py before making changes.
High-intent search queries and answers about installing and using this skill.
Run python3 reference/scripts/advise.py --file <target_file> from the repository root. The script queries the Mantis SQLite knowledge base and prints an advisory with threat models, historical vulnerabilities, verified patches, and false positive context for that file.
Use the --lineage flag with a lineage UUID, or --signature with a content signature hash, when running advise.py. This returns the lifecycle and recurrence history for that specific bug chain.
Yes, add the --json flag to the advise.py command to emit structured JSON instead of formatted markdown. This is intended for consumption by agent harnesses and automated pipelines.
All knowledge lives in a SQLite database named knowledge.db, which the script auto-discovers in the repository root or workspace directory. It reads the findings, campaign_artifacts, learnings, and risk_scores tables rather than flat files on disk.
Do not use it for automated multi-pass red-team exploitation or fuzzing, as stated in its description. It is a guardrail and advisory tool for secure development, not an offensive exploitation framework.
NASA-PDSApply CSV triage decisions to SonarCloud security issues via API.
githubnextUpdates compat.json version enforcement policies based on verified GitHub security advisories.
thisisqubikaAnalyze code repositories for vulnerabilities using SAST and AI triage.
rijnbGround conversation answers exclusively in curated wiki knowledge base pages.