스킬 mantis-threat-model

📦

mantis-threat-model

Name: mantis-threat-model
Author: google

콘텐츠 리비전 r1 낮은 위험 ⚙️ 외부 명령어📁 파일 시스템 접근

Build Threat Models from Your Mantis Knowledge Base

Architecture notes often leave attacker access and trust boundaries unclear. This skill turns existing Mantis knowledge into a structured threat model with deployment intent and snapshot provenance.

지원: Claude Codex Code(CC)

📊 74 적절함

Maintain this Skill? Claim it 📊 74 적절함

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "mantis-threat-model" from https://skillstore.io/skills/google-mantis-threat-model.md and its manifest at https://skillstore.io/api/skills/google-mantis-threat-model/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/google-mantis-threat-model.md 서명된 manifest GET /api/skills/google-mantis-threat-model/manifest 서명된 lockfile GET /api/skills/google-mantis-threat-model/lockfile

테스트해 보기

"mantis-threat-model" 사용 중입니다. Generate a model from a KB describing a public API, an authentication service, and a customer database.

예상 결과:

System overview: The public API accepts client requests and delegates identity checks to the authentication service.
Deployment intent: Production, because the KB describes an externally reachable service.
Trust boundary: Untrusted requests cross into authenticated application operations at the API authorization layer.
Threat actor: An unauthenticated network attacker can reach the API entry point.
High-risk asset: Customer records require confidentiality and integrity protections.

"mantis-threat-model" 사용 중입니다. Rerun the model using the same recorded snapshot and reuse the existing model content.

예상 결과:

Snapshot provenance: The model retains the current snapshot identifier.
Freshness warning: The threat model was not reevaluated this pass and was carried forward from the unchanged snapshot.
Archive action: The prior model is copied to the pass archive before replacement.

보안 감사

낮은 위험

v1 • 2026. 10. 4. 버전별 보고서 열기

All 101 static findings are false positives involving Markdown formatting, expected workspace metadata, or locator checks skipped by this KB-only stage. No evidence found of credential theft, exfiltration, malicious execution, or audit-directed prompt injection. One semantic finding identifies potential archive-history loss when the same pass is rerun.

스캔된 파일

252

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

낮음

SKILL.md:143-151

Repeated Passes Can Replace Archive History

The same pass number selects the same archive filename on repeated runs. Copying the current model there can replace earlier history without a collision check.

The procedure explicitly copies to a pass-number filename but provides no protection for an existing archive. This establishes a potential history-loss risk, not observed exploitation.

위험 요인

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (7)

SKILL.md:37 SKILL.md:71 SKILL.md:77 SKILL.md:95 SKILL.md:97 SKILL.md:143 SKILL.md:92

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/google-mantis-threat-model/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-mantis-threat-model/security.svg)](https://skillstore.io/skills/google-mantis-threat-model?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/google-mantis-threat-model?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-threat-model/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/google-mantis-threat-model.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

google. (2026). mantis-threat-model security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-threat-model/audits/1

BibTeX 인용

@techreport{google-google-mantis-threat-model-2026,
  author = {google},
  title = {mantis-threat-model security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/google-mantis-threat-model/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-threat-model security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-threat-model/audits/1"
identifiers:
  - type: other
    value: "skillstore:google-mantis-threat-model:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Review Architectural Exposure

Identify attacker entry points and trust boundaries from an existing Mantis architecture knowledge base.

Refresh Models After Snapshot Changes

Regenerate threat-model sections and reassess deployment intent when the recorded snapshot changes.

Prepare Security Planning Context

Provide downstream planning agents with attacker profiles, entity references, and asset availability classifications.

이 프롬프트를 사용해 보세요

Create an Initial Model

Run /mantis-threat-model using the populated Mantis knowledge base in the current workspace.

Use a Separate State Directory

Run /mantis-threat-model --state_root [state_directory]. Use its architecture and entity documents, archive the prior model, and save the replacement.

Refresh for a New Snapshot

Run /mantis-threat-model --state_root [state_directory] --snapshot_id [snapshot_id]. Recompute deployment intent when provenance changes and default to production for uncertain evidence.

Review Reuse and Archive Integrity

Run /mantis-threat-model --state_root [state_directory] --snapshot_id [snapshot_id]. Preserve existing archives; add the required STALE banner if unchanged provenance leads to reused content.

모범 사례

Populate architecture and entity documents with current deployment, entrypoint, and availability evidence before running the skill.
Keep snapshot identifiers consistent with the knowledge base revision and review models marked stale.
Preserve existing pass archives and verify the backup before replacing the live threat model.

피하기

Using this skill as a source-code scanner or JSONL learning extractor.
Declaring a system sample-only when production evidence is missing, contradictory, or uncertain.
Treating unchanged snapshot labels as proof that the knowledge base is current or rerunning passes without archive protection.

자주 묻는 질문

What inputs does this skill require?

It requires populated Mantis architecture and entity documents. Workflow state and an existing model provide optional pass and provenance metadata.

Does it inspect application source code?

No. This KB-only stage reads synthesized architecture and entity documents, not target source code or raw JSONL learnings.

Where is the threat model saved?

It saves THREAT_MODEL.md in the selected state workspace KB and copies the previous model into the pass archive.

What happens when snapshot metadata is missing?

Without an explicit snapshot identifier or pinned state metadata, it uses UNPINNED provenance and rederives the model.

How does it classify deployment intent?

It allows sample-only classification only when all five production-signal checks pass. Any uncertainty requires production classification.

Can repeated runs affect model history?

Yes. Reusing a pass number can replace its archived model. Preserve existing archives before rerunning the same pass.

개발자 세부 정보

작성자

google

라이선스

MIT

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/google/mantis/tree/f48a85e8823ee6f4824ae9a24b9b2efb8aab8c9a/mantis-threat-model

참조

afe56992452feed3201cea1348a69613bf5d0a6d

유지보수 최신성

2026. 10. 5.

사용량

0 다운로드 · 0 조회

파일 구조

📄 SKILL.md