skills.rest
google
googleOFFICIAL
Explore all skills by this author →
Website𝕏@GoogleOSSGitHub

mantis-launch

Launches automated vulnerability review campaigns on target files or repositories.

865|94|Updated Jun 15, 2026
Search Tags:#static analysis#security review#vulnerability scanning#lLM#automated patching#exploit verification#Sandbox
One-click install
npx skills add https://github.com/google/mantis --skill mantis-launch
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mantis-launch
Source: https://github.com/google/mantis/tree/main/reference/skills/mantis-launch
Command: npx skills add https://github.com/google/mantis --skill mantis-launch

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Running multi-stage security reviews manually requires configuring sandboxes, models, and credentials before any scanning can begin. This Skill automates the launch of end-to-end vulnerability discovery pipelines with preflight checks and environment auto-configuration.

Core Features & Use Cases

  • Automated Campaign Launch: Initiates vulnerability discovery, verification, exploit analysis, crash reproduction, patch generation, and risk calibration across a file or repository.
  • Environment Auto-Healing: Detects unconfigured placeholders in workflow.json, resolves GCP credentials and virtualization capabilities, and falls back to static-only analysis when needed.
  • Runtime Overrides: Supports CLI flags for sandbox type, AI model, API endpoints, reasoning effort, timeouts, and custom workflow definitions.
  • Use Case: Point the launcher at a repository to run a full security review campaign, then query findings, patches, and risk scores stored in knowledge.db.

Quick Start

Ask the agent to launch a Mantis vulnerability review on your target directory, for example by running ./reference/run.sh . from the repository root.

Frequently Asked Questions about mantis-launch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I launch an automated vulnerability review on a repository?▼

Run ./reference/run.sh followed by the target path, such as a single source file or a repository root directory. The launcher performs preflight checks, auto-configures the environment, and starts the full review pipeline.

How do I run a security scan without a sandbox environment?▼

Use the --sandbox static-only flag to run static analysis only, which requires no sandbox infrastructure. The launcher also falls back to static-only automatically if no virtualization capabilities are detected.

Can I use a custom LLM or local model server for the review?▼

Yes, pass --model with a provider prefix such as vertex_ai/ or openai/, and use --api-base to point at an OpenAI-compatible endpoint like a local vLLM or Ollama server.

How do I verify my environment is ready before scanning?▼

Run the launcher with --preflight-only to execute the roughly one-second sanity check that validates LLM credentials and sandbox operability without starting a campaign.

Where are vulnerability findings stored after a campaign?▼

All findings, exploit reproduction logs, verified patches, and risk calibration scores are recorded in knowledge.db, with session trajectories in sessions.db. You can query results using the mantis-advise script.

Related Skills

Explore More Software Engineering Skills→
hepai-labhepai-lab
21

download_github_skills

Download a targeted skill folder from a GitHub repository using sparse-checkout.

Community
Intermediate
MinhThang1009MinhThang1009
15

modernize-harden

Scan legacy code for security vulnerabilities and generate a reviewable remediation patch.

Community
Intermediate
googlegoogle
731

mantis-reproduce

Generate and execute crash reproduction scripts in isolated sandbox environments.

Official
Advanced
Exocore-OrganizationExocore-Organization
5

security_scan

Orchestrate three security scanners in parallel and generate a prioritized risk summary.

Official
Advanced