Validate security findings against source code snapshots to filter false positives.
npx skills add https://github.com/google/mantis --skill mantis-review
Please help me install this Agent Skill. Skill: mantis-review Source: https://github.com/google/mantis/tree/main/mantis-review Command: npx skills add https://github.com/google/mantis --skill mantis-review
This Skill addresses the high volume of false positives generated by automated security scanners by independently verifying findings against the actual source code.
Run the mantis-review command to validate all findings in the current workspace against the pinned source code snapshot.
High-intent search queries and answers about installing and using this skill.
Automated security finding validation cross-references raw scanner alerts against source code snapshots to filter noise. It systematically disproves non-exploitable issues using strict negative constraints, ensuring only genuine vulnerabilities are highlighted for human review.
Snapshot provenance validates security findings against the exact pinned source code state they were discovered in. This prevents drift-related errors during automated triage, ensuring deterministic verification of vulnerabilities within the target repository code root.
Yes, the adversarial validation mechanism processes large batches of raw security alerts by applying 13 strict negative constraints. This automatically filters out non-exploitable issues from the CI/CD pipeline, requiring workspace findings and state files to operate.
The best way to filter scanner noise is independent adversarial validation against the actual source code. By systematically disproving findings based on strict negative constraints, it ensures alerts are grounded in actual code logic before human review.
Yes, deterministic security triage requires access to workspace findings, state files, and the target repository code root. These inputs allow the validation process to independently verify automated scanner alerts against the exact source code snapshot.
False positives persist because automated scanners often lack deep code logic context. Adversarial validation solves this by independently verifying findings against source code snapshots and applying strict negative constraints to systematically disprove non-exploitable alerts.
googleMerge redundant security findings into unique records with audit history.
SHAdd0WTAkaGenerate and verify exploit PoCs in sandboxed environments with auditable reports.
eliottbusinessAutomate pre-commit code review with static analysis and security scanning.
dreadnodeSearch and replay HTTP proxy traffic via Caido MCP tools.
