📦

mantis-dedupe

Name: mantis-dedupe
Author: google

Révision du contenu r1 Risque élevé ⚙️ Commandes externes📁 Accès au système de fichiers

Consolidate Duplicate Security Findings

Repeated security findings increase review effort and can obscure regressions. This skill guides consolidation while preserving provenance, active regression candidates, and transaction history.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "mantis-dedupe" from https://skillstore.io/skills/google-mantis-dedupe.md and its manifest at https://skillstore.io/api/skills/google-mantis-dedupe/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/google-mantis-dedupe.md manifest signé GET /api/skills/google-mantis-dedupe/manifest lockfile signé GET /api/skills/google-mantis-dedupe/lockfile

Tester

Utilisation de « mantis-dedupe ». Two findings describe the same flaw at the same line and share discovery provenance.

Résultat attendu:

One primary finding retains its identifier and the highest reported severity.
Descriptions, code paths, and history are consolidated.
The duplicate is staged with linkage to the primary finding, and its move is logged.

Utilisation de « mantis-dedupe ». A new finding matches a resolved archived issue, but their discovery snapshots differ.

Résultat attendu:

The new finding remains active.
A possible duplicate hint references the archived finding.
History records a possible regression; the finding is not moved to staging.

Utilisation de « mantis-dedupe ». Two findings have matching signatures and titles but identify different lines in the same file.

Résultat attendu:

The findings remain separate because their line-inclusive locations differ.
Signature agreement alone does not justify a duplicate status or staged removal.

Audit de sécurité

Risque élevé

v1 • 04/10/2026 Ouvrir le rapport versionné

The 160 static alerts describe Markdown notation, legitimate workspace operations, and defensive snapshot checks rather than the alleged execution or reconnaissance threats. Semantic review found unsafe helper reuse and potential disclosure of sensitive vulnerability summaries through external embeddings. No evidence found of malicious intent or instructions to manipulate this audit.

Fichiers analysés

372

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Élevé

SKILL.md:312-318 SKILL.md:349-350

Version Comment Does Not Authenticate Reused Helpers

The skill says, "Only reuse it when the marker matches." A modified helper can retain the expected comment and execute unauthorized code.

The instructions explicitly authorize helper reuse based on a version comment and later execute it. No content-integrity verification is specified.

Moyen

SKILL.md:264-278

External Embeddings May Disclose Vulnerability Details

The semantic fallback embeds root-cause summaries using a configured provider, defaulting to Vertex AI. These summaries include vulnerability mechanisms and dataflow without a disclosure-approval requirement.

The instructions specify sensitive summary fields and an external default embedding provider. Actual transmission depends on configured integration; no evidence found of malicious exfiltration intent.

Facteurs de risque

⚙️ Commandes externes (50)

📁 Accès au système de fichiers (16)

SKILL.md:33 SKILL.md:35 SKILL.md:40 SKILL.md:51 SKILL.md:68 SKILL.md:74 SKILL.md:92 SKILL.md:94 SKILL.md:110 SKILL.md:192 SKILL.md:193 SKILL.md:354 SKILL.md:357 SKILL.md:358 SKILL.md:360 SKILL.md:89

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/google-mantis-dedupe/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-mantis-dedupe/security.svg)](https://skillstore.io/skills/google-mantis-dedupe?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/google-mantis-dedupe?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-dedupe/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/google-mantis-dedupe.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

google. (2026). mantis-dedupe security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-dedupe/audits/1

Citation BibTeX

@techreport{google-google-mantis-dedupe-2026,
  author = {google},
  title = {mantis-dedupe security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/google-mantis-dedupe/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-dedupe security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-dedupe/audits/1"
identifiers:
  - type: other
    value: "skillstore:google-mantis-dedupe:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Prepare a Security Review Queue

Consolidate repeated reports at identical locations while retaining severity, supporting details, and review history.

Preserve Regression Candidates Across Passes

Compare new findings with archived records and retain possible regressions when discovery snapshots differ.

Maintain Traceable Finding Pipelines

Process large queues with grouped comparisons, provenance checks, staged duplicates, and transaction records.

Essayez ces prompts

Inspect a Small Finding Queue

Review the existing findings and identify duplicate candidates. Explain the matching evidence before changing any files.

Consolidate Current-Batch Duplicates

Consolidate findings with identical line-inclusive locations and matching titles. Preserve provenance and history, stage duplicates, and summarize changes.

Compare Findings Across Snapshots

Compare current and archived findings using pairwise discovery provenance. Keep unmatched findings active and annotate regressions against resolved archived issues.

Process a Large Queue Safely

Group findings by component, verify helpers before execution, and apply snapshot-gated matching. Require approval before external embeddings and summarize staged moves.

Bonnes pratiques

Back up workspace state and review matching evidence before applying consolidation.
Verify helper contents independently before execution; a version comment does not establish trust.
Approve external embedding use explicitly and redact sensitive vulnerability details before transmission.

Éviter

Marking findings as duplicates based only on signatures, without line-inclusive location agreement.
Suppressing potential regressions or merging findings from different discovery versions.
Executing existing helpers solely because their version comments match.

Foire aux questions

Which AI tools can use this skill?

The marketplace lists Claude, Codex, and Claude Code. Workspace file access and command execution are needed to apply merges.

Does this skill discover new vulnerabilities?

No. It consolidates existing findings and identifies possible regressions during archive comparisons. Initial auditing and patch generation are outside its scope.

Are duplicate files permanently deleted?

No. Duplicates receive status and linkage metadata, move into a staging directory, and generate transaction records.

What happens when discovery snapshots differ?

Snapshot-gated archive matches remain active with a possible duplicate hint. Resolved archived matches receive possible regression notes.

Does deduplication require an external service?

Exact matching does not inherently require external embeddings. Semantic fallback requires configured embedding infrastructure and defaults to a Vertex AI model.

Is an existing helper safe when its version matches?

No. A matching comment does not verify script contents. Independently inspect or regenerate helpers before execution.

Détails du développeur

Auteur

google

Licence

MIT

Révision Skillstore

Avis de version

L’auteur n’a déclaré aucune version.

Dépôt

https://github.com/google/mantis/tree/f48a85e8823ee6f4824ae9a24b9b2efb8aab8c9a/mantis-dedupe

Réf

ac1a468421c65e380e46c4c08b5b3b8faaa5aa45

Récence de maintenance

05/10/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md