スキル mantis-structural-index
📦
mantis-structural-index
コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド📁 ファイルシステムへのアクセス
Build Snapshot-Aware Source Code Indexes
Large source trees make symbol navigation and caller discovery expensive. This skill guides structural indexing with reusable caches and coverage-aware queries while preserving lexical discovery.
対応: Claude Codex Code(CC)
インストール前に停止して確認を求めてください。
計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "mantis-structural-index" from https://skillstore.io/skills/google-mantis-structural-index.md and its manifest at https://skillstore.io/api/skills/google-mantis-structural-index/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「mantis-structural-index」を使用しています。 Illustrative request: index a live repository using only a heuristic backend.
期待される結果:
- Snapshot provenance: unknown; a fresh build is required.
- Backend precision: heuristic; structural matches remain advisory.
- Returned artifacts: manifest, SQLite catalog, and query helper.
- Coverage summary distinguishes indexed, deferred, and failed files.
「mantis-structural-index」を使用しています。 Illustrative request: find callers when the relevant partition is only partially indexed.
期待される結果:
- Result status: no indexed callers; coverage is partial.
- This does not establish that the function has no callers.
- Run lexical discovery and retain all candidates alongside structural hints.
セキュリティ監査
高リスクv1 • 2026/10/4 バージョン別レポートを開く
All 225 static matches are documentation syntax or legitimate indexing operations, not the reported threats. Semantic review identifies forgeable helper-version checks and missing remote-query disclosure controls. No evidence found of malicious payloads, credential theft, or audit-directed prompt injection in the supplied skill.
1
スキャンされたファイル
747
解析済み行数
0
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (2)
高
Helper Reuse Relies on a Forgeable Version Marker
Existing executable helpers are reused after checking only the marker '# MANTIS_HELPER_VERSION = 5'. An attacker who can modify workspace helpers can retain that marker and substitute code executed during indexing or queries.
The instructions explicitly permit helper reuse based on a public version comment without requiring content integrity or trusted ownership. Exploitation requires workspace write access; no actual substituted helper was supplied.
中
Remote Queries Lack an Explicit Data-Disclosure Boundary
Remote query providers can be selected through MANTIS_STRUCTURAL_INDEX_URL or manifest configuration. Symbol and file queries may disclose repository metadata without required endpoint approval, transport protection, or a data-sharing policy.
The specification offers remote access to operations accepting symbol names and file paths but states no explicit endpoint or disclosure restrictions. No evidence found of a malicious destination or implemented transfer; this is a conditional design risk.
リスク要因
⚙️ 外部コマンド (50)
SKILL.md:14 SKILL.md:15 SKILL.md:21 SKILL.md:22 SKILL.md:30 SKILL.md:32 SKILL.md:34 SKILL.md:36 SKILL.md:41 SKILL.md:43 SKILL.md:45 SKILL.md:47 SKILL.md:49 SKILL.md:52 SKILL.md:54 SKILL.md:56 SKILL.md:58 SKILL.md:60 SKILL.md:62 SKILL.md:64 SKILL.md:66 SKILL.md:68 SKILL.md:70 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:78 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:93-132 SKILL.md:132-142 SKILL.md:142 SKILL.md:143-144 SKILL.md:144-147 SKILL.md:147-148 SKILL.md:148-149 SKILL.md:149 SKILL.md:150-153 SKILL.md:153 SKILL.md:154 SKILL.md:155 SKILL.md:157-158 SKILL.md:158-171 SKILL.md:171-172 SKILL.md:172 SKILL.md:174-175 SKILL.md:175-177 SKILL.md:177 SKILL.md:178-180
📁 ファイルシステムへのアクセス (9)
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/google-mantis-structural-index/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/google-mantis-structural-index?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/google-mantis-structural-index?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-structural-index/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/google-mantis-structural-index.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
google. (2026). mantis-structural-index security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-structural-index/audits/1BibTeX形式の引用
@techreport{google-google-mantis-structural-index-2026,
author = {google},
title = {mantis-structural-index security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/google-mantis-structural-index/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-structural-index security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-structural-index/audits/1"
identifiers:
- type: other
value: "skillstore:google-mantis-structural-index:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠
作成できるもの
Navigate an Unfamiliar Codebase
Build source cross-references, resolve ambiguous symbols, and locate enclosing functions before reading implementation details.
Prioritize Security Research
Rank candidate call sites with structural hints while retaining every candidate found through repository-wide lexical discovery.
Reuse Indexing Work Across Snapshots
Reuse unchanged semantic units and report coverage, provenance, and deferred work for repeated analysis runs.
これらのプロンプトを試す
Index the Current Repository
Build a local structural index for the current repository. Use unknown snapshot provenance, report coverage and backend precision, and preserve source files.
Resolve a Symbol and Its Callers
Resolve [symbol name] in [language or file]. Ask me to disambiguate matches, then list paginated caller hints with precision and coverage. Include lexical candidates.
Index a Pinned Snapshot
Index [snapshot root] using [snapshot ID] and [state root]. Verify provenance, reuse matching units, keep the snapshot read-only, and report deferred partitions.
Plan a Large Incremental Build
Index [snapshot root] locally with approved backends and verified helpers. Prioritize [target files] and changed units within [unit and byte limits]. Report reuse, remaining work, and coverage without excluding lexical candidates.
ベストプラクティス
- Validate snapshot provenance and keep generated artifacts outside pinned source trees.
- Verify helper integrity before execution and approve any remote provider before sharing repository metadata.
- Inspect precision and coverage, disambiguate symbols, and combine structural results with lexical discovery.
回避
- Treating an empty structural query as proof that no callers exist.
- Reusing an unknown-snapshot index against a mutable live tree.
- Executing modified helpers solely because their version comment matches.
よくある質問
Does this skill include executable indexing scripts?
No. The supplied file defines instructions and contracts. The agent generates builder and query helpers at runtime.
Can it run without a pinned snapshot?
Yes. It indexes the current directory with unknown provenance and rebuilds on every invocation.
Which indexing backends can it use?
It selects available backends per partition, including matched native indexes, compiler extractors, AST parsers, symbol tools, heuristics, and lexical fallback.
Does it replace repository-wide lexical searches?
No. Structural results are advisory. Consumers must retain lexical candidates and combine both result sets.
Can it analyze vulnerabilities or generate patches?
No. Its scope is source cross-reference data. Findings analysis, patching, reporting, and production build reachability are outside its scope.
Does it send repository information to remote services?
Local indexing does not require a remote provider. Optional remote queries can disclose symbol and file metadata; approve the destination before enabling them.