Compétences mantis-calibrate

📦

mantis-calibrate

Name: mantis-calibrate
Author: google

Révision du contenu r1 Risque élevé ⚙️ Commandes externes📁 Accès au système de fichiers

Calibrate Mantis Security Findings

Security findings need consistent priorities grounded in exploit evidence and architectural context. This skill applies a risk matrix and documented caps to existing Mantis findings.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "mantis-calibrate" from https://skillstore.io/skills/google-mantis-calibrate.md and its manifest at https://skillstore.io/api/skills/google-mantis-calibrate/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/google-mantis-calibrate.md manifest signé GET /api/skills/google-mantis-calibrate/manifest lockfile signé GET /api/skills/google-mantis-calibrate/lockfile

Tester

Utilisation de « mantis-calibrate ». Impact 4, likelihood 3, internal exposure, viable production finding, and no additional caps.

Résultat attendu:

Risk score: 5.6. Priority: MEDIUM. Internal exposure applies a 0.8 multiplier to the combined impact and likelihood.

Utilisation de « mantis-calibrate ». A pinned finding has failed reproduction, but its discovery snapshot does not match the active snapshot.

Résultat attendu:

STALE_EVIDENCE: reproduction evidence does not match the active snapshot.
Reproduction failure rule: UNKNOWN. Do not force LOW based on stale evidence.
Keep the conservative calculated score and record the provenance warning.

Utilisation de « mantis-calibrate ». A viable finding has an unresolved physical-access prerequisite during calibration.

Résultat attendu:

Calibration is provisional. Mark the physical-access rule UNKNOWN, retain the calculated priority, and request evidence resolving the prerequisite.

Audit de sécurité

Risque élevé

v1 • 04/10/2026 Ouvrir le rapport versionné

All 203 static detections are false positives involving Markdown syntax, workflow metadata, or descriptions of vulnerability evidence. One semantic finding identifies helper reuse without integrity verification, enabling code execution if an attacker controls the workspace helper. No evidence found of deliberate prompt injection or data exfiltration in the supplied files.

Fichiers analysés

914

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Élevé

SKILL.md:554-560 SKILL.md:562-572

Workspace Helper Reuse Without Integrity Verification

The skill executes an existing workspace helper after checking only "# MANTIS_HELPER_VERSION = 2". An attacker controlling that helper can retain the comment and execute arbitrary code with agent permissions.

The instructions explicitly combine helper execution with a first-line version check, without requiring body verification. Exploitation requires attacker control of the workspace helper; no malicious helper is supplied.

Facteurs de risque

⚙️ Commandes externes (50)

📁 Accès au système de fichiers (7)

SKILL.md:29 SKILL.md:71 SKILL.md:77 SKILL.md:95 SKILL.md:97 SKILL.md:117 SKILL.md:92

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/google-mantis-calibrate/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-mantis-calibrate/security.svg)](https://skillstore.io/skills/google-mantis-calibrate?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/google-mantis-calibrate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-calibrate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/google-mantis-calibrate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

google. (2026). mantis-calibrate security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-calibrate/audits/1

Citation BibTeX

@techreport{google-google-mantis-calibrate-2026,
  author = {google},
  title = {mantis-calibrate security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/google-mantis-calibrate/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-calibrate security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-calibrate/audits/1"
identifiers:
  - type: other
    value: "skillstore:google-mantis-calibrate:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Prioritize Existing Vulnerabilities

Calibrate completed findings with exploit evidence, exposure, and blast radius to support remediation planning.

Review Project Threat Context

Apply project threat models and asset criticality when assessing findings across internal components and public interfaces.

Track Evidence Across Pipeline Passes

Record snapshot provenance, stale evidence, and unresolved calibration rules in finding histories for later review.

Essayez ces prompts

Review Calibration Inputs

Review my existing Mantis findings without modifying files. Identify missing reproduction, viability, and threat-model information needed for calibration.

Calibrate a Finding

Calibrate finding [finding_id] using its evidence and threat model. Explain the score, priority, and applicable caps before updating the file.

Audit Unresolved Rules

Review calibrated findings for UNKNOWN rules and stale evidence. Explain which priorities remain provisional and what evidence would resolve each warning.

Calibrate a Pinned Batch

Calibrate findings using [snapshot_root] and [state_root]. Verify pass alignment, preserve conservative scores for stale evidence, and review helper integrity before execution.

Bonnes pratiques

Provide reproduction results, production viability, attacker prerequisites, and a current threat model before calibration.
Use matching pinned snapshots and review every stale-evidence or UNKNOWN warning before accepting priorities.
Back up finding files and verify complete helper contents before executing generated or reused scripts.

Éviter

Use calibration to discover new vulnerabilities or implement patches.
Treat missing reproduction or threat-model information as proof that a finding is harmless.
Execute existing workspace helpers solely because their version comment matches.

Foire aux questions

What does this skill calculate?

It calculates impact, likelihood, context-adjusted risk scores, and priorities for eligible existing Mantis findings.

Does it find vulnerabilities or fix code?

No. It calibrates findings already produced by earlier pipeline stages and updates their reporting fields.

What happens when evidence fields are missing?

Missing viability defaults to CONDITIONAL_VIABLE, and missing reproduction defaults to not_attempted. Applicable rules can reduce priority, except where stale-evidence safeguards apply.

Does calibration require a pinned snapshot?

No. Without active snapshot state, it uses default mode without provenance checks. Pinned and HALT modes enable conservative stale-evidence handling.

Which files can it change?

It updates workspace finding files and creates a reusable calibration helper. Pinned target source must remain unchanged.

Is the helper version check sufficient for security?

No. A matching comment does not establish integrity. Review complete helper contents or regenerate from trusted templates before execution.