스킬 mantis-dedupe
📦
mantis-dedupe
콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어📁 파일 시스템 접근
Consolidate Duplicate Security Findings
Repeated security findings increase review effort and can obscure regressions. This skill guides consolidation while preserving provenance, active regression candidates, and transaction history.
지원: Claude Codex Code(CC)
설치 전에 중지하고 확인을 요청하세요.
계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "mantis-dedupe" from https://skillstore.io/skills/google-mantis-dedupe.md and its manifest at https://skillstore.io/api/skills/google-mantis-dedupe/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"mantis-dedupe" 사용 중입니다. Two findings describe the same flaw at the same line and share discovery provenance.
예상 결과:
- One primary finding retains its identifier and the highest reported severity.
- Descriptions, code paths, and history are consolidated.
- The duplicate is staged with linkage to the primary finding, and its move is logged.
"mantis-dedupe" 사용 중입니다. A new finding matches a resolved archived issue, but their discovery snapshots differ.
예상 결과:
- The new finding remains active.
- A possible duplicate hint references the archived finding.
- History records a possible regression; the finding is not moved to staging.
"mantis-dedupe" 사용 중입니다. Two findings have matching signatures and titles but identify different lines in the same file.
예상 결과:
- The findings remain separate because their line-inclusive locations differ.
- Signature agreement alone does not justify a duplicate status or staged removal.
보안 감사
높은 위험v1 • 2026. 10. 4. 버전별 보고서 열기
The 160 static alerts describe Markdown notation, legitimate workspace operations, and defensive snapshot checks rather than the alleged execution or reconnaissance threats. Semantic review found unsafe helper reuse and potential disclosure of sensitive vulnerability summaries through external embeddings. No evidence found of malicious intent or instructions to manipulate this audit.
1
스캔된 파일
372
분석된 줄 수
0
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (2)
높음
Version Comment Does Not Authenticate Reused Helpers
The skill says, "Only reuse it when the marker matches." A modified helper can retain the expected comment and execute unauthorized code.
The instructions explicitly authorize helper reuse based on a version comment and later execute it. No content-integrity verification is specified.
중간
External Embeddings May Disclose Vulnerability Details
The semantic fallback embeds root-cause summaries using a configured provider, defaulting to Vertex AI. These summaries include vulnerability mechanisms and dataflow without a disclosure-approval requirement.
The instructions specify sensitive summary fields and an external default embedding provider. Actual transmission depends on configured integration; no evidence found of malicious exfiltration intent.
위험 요인
⚙️ 외부 명령어 (50)
SKILL.md:19 SKILL.md:23 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:33 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:45 SKILL.md:47 SKILL.md:51 SKILL.md:52 SKILL.md:58-97 SKILL.md:97-100 SKILL.md:100 SKILL.md:101-103 SKILL.md:103-104 SKILL.md:104-105 SKILL.md:105-107 SKILL.md:107-108 SKILL.md:108-110 SKILL.md:110 SKILL.md:111 SKILL.md:123-125 SKILL.md:125-128 SKILL.md:128-129 SKILL.md:129-133 SKILL.md:133-136 SKILL.md:136-137 SKILL.md:137-138 SKILL.md:138-139 SKILL.md:139 SKILL.md:143-148 SKILL.md:148 SKILL.md:149 SKILL.md:150 SKILL.md:151 SKILL.md:152-153 SKILL.md:153-154 SKILL.md:154-155 SKILL.md:155 SKILL.md:156-157 SKILL.md:157 SKILL.md:161-162
감사자: codex
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/google-mantis-dedupe/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/google-mantis-dedupe?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/google-mantis-dedupe?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-dedupe/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/google-mantis-dedupe.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
google. (2026). mantis-dedupe security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-dedupe/audits/1BibTeX 인용
@techreport{google-google-mantis-dedupe-2026,
author = {google},
title = {mantis-dedupe security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/google-mantis-dedupe/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-dedupe security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-dedupe/audits/1"
identifiers:
- type: other
value: "skillstore:google-mantis-dedupe:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 중간 55
아키텍처
85
유지보수성
87
콘텐츠
65
커뮤니티
91
사양 준수
만들 수 있는 것
Prepare a Security Review Queue
Consolidate repeated reports at identical locations while retaining severity, supporting details, and review history.
Preserve Regression Candidates Across Passes
Compare new findings with archived records and retain possible regressions when discovery snapshots differ.
Maintain Traceable Finding Pipelines
Process large queues with grouped comparisons, provenance checks, staged duplicates, and transaction records.
이 프롬프트를 사용해 보세요
Inspect a Small Finding Queue
Review the existing findings and identify duplicate candidates. Explain the matching evidence before changing any files.
Consolidate Current-Batch Duplicates
Consolidate findings with identical line-inclusive locations and matching titles. Preserve provenance and history, stage duplicates, and summarize changes.
Compare Findings Across Snapshots
Compare current and archived findings using pairwise discovery provenance. Keep unmatched findings active and annotate regressions against resolved archived issues.
Process a Large Queue Safely
Group findings by component, verify helpers before execution, and apply snapshot-gated matching. Require approval before external embeddings and summarize staged moves.
모범 사례
- Back up workspace state and review matching evidence before applying consolidation.
- Verify helper contents independently before execution; a version comment does not establish trust.
- Approve external embedding use explicitly and redact sensitive vulnerability details before transmission.
피하기
- Marking findings as duplicates based only on signatures, without line-inclusive location agreement.
- Suppressing potential regressions or merging findings from different discovery versions.
- Executing existing helpers solely because their version comments match.
자주 묻는 질문
Which AI tools can use this skill?
The marketplace lists Claude, Codex, and Claude Code. Workspace file access and command execution are needed to apply merges.
Does this skill discover new vulnerabilities?
No. It consolidates existing findings and identifies possible regressions during archive comparisons. Initial auditing and patch generation are outside its scope.
Are duplicate files permanently deleted?
No. Duplicates receive status and linkage metadata, move into a staging directory, and generate transaction records.
What happens when discovery snapshots differ?
Snapshot-gated archive matches remain active with a possible duplicate hint. Resolved archived matches receive possible regression notes.
Does deduplication require an external service?
Exact matching does not inherently require external embeddings. Semantic fallback requires configured embedding infrastructure and defaults to a Vertex AI model.
Is an existing helper safe when its version matches?
No. A matching comment does not verify script contents. Independently inspect or regenerate helpers before execution.