Навыки mantis-structural-index

📦

mantis-structural-index

Name: mantis-structural-index
Author: google

Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды📁 Доступ к файловой системе

Build Snapshot-Aware Source Code Indexes

Large source trees make symbol navigation and caller discovery expensive. This skill guides structural indexing with reusable caches and coverage-aware queries while preserving lexical discovery.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "mantis-structural-index" from https://skillstore.io/skills/google-mantis-structural-index.md and its manifest at https://skillstore.io/api/skills/google-mantis-structural-index/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/google-mantis-structural-index.md Подписанный manifest GET /api/skills/google-mantis-structural-index/manifest Подписанный lockfile GET /api/skills/google-mantis-structural-index/lockfile

Протестировать

Использование «mantis-structural-index». Illustrative request: index a live repository using only a heuristic backend.

Ожидаемый результат:

Snapshot provenance: unknown; a fresh build is required.
Backend precision: heuristic; structural matches remain advisory.
Returned artifacts: manifest, SQLite catalog, and query helper.
Coverage summary distinguishes indexed, deferred, and failed files.

Использование «mantis-structural-index». Illustrative request: find callers when the relevant partition is only partially indexed.

Ожидаемый результат:

Result status: no indexed callers; coverage is partial.
This does not establish that the function has no callers.
Run lexical discovery and retain all candidates alongside structural hints.

Аудит безопасности

Высокий риск

v1 • 04.10.2026 Открыть версионный отчет

All 225 static matches are documentation syntax or legitimate indexing operations, not the reported threats. Semantic review identifies forgeable helper-version checks and missing remote-query disclosure controls. No evidence found of malicious payloads, credential theft, or audit-directed prompt injection in the supplied skill.

Просканировано файлов

747

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

SKILL.md:260-271 SKILL.md:296-301

Helper Reuse Relies on a Forgeable Version Marker

Existing executable helpers are reused after checking only the marker '# MANTIS_HELPER_VERSION = 5'. An attacker who can modify workspace helpers can retain that marker and substitute code executed during indexing or queries.

The instructions explicitly permit helper reuse based on a public version comment without requiring content integrity or trusted ownership. Exploitation requires workspace write access; no actual substituted helper was supplied.

Средний

SKILL.md:302-304 SKILL.md:647-675 SKILL.md:677-685

Remote Queries Lack an Explicit Data-Disclosure Boundary

Remote query providers can be selected through MANTIS_STRUCTURAL_INDEX_URL or manifest configuration. Symbol and file queries may disclose repository metadata without required endpoint approval, transport protection, or a data-sharing policy.

The specification offers remote access to operations accepting symbol names and file paths but states no explicit endpoint or disclosure restrictions. No evidence found of a malicious destination or implemented transfer; this is a conditional design risk.

Факторы риска

⚙️ Внешние команды (50)

📁 Доступ к файловой системе (9)

SKILL.md:744 SKILL.md:41 SKILL.md:103 SKILL.md:109 SKILL.md:127 SKILL.md:129 SKILL.md:64 SKILL.md:312 SKILL.md:124

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/google-mantis-structural-index/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-mantis-structural-index/security.svg)](https://skillstore.io/skills/google-mantis-structural-index?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/google-mantis-structural-index?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-structural-index/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/google-mantis-structural-index.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

google. (2026). mantis-structural-index security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-structural-index/audits/1

Цитата BibTeX

@techreport{google-google-mantis-structural-index-2026,
  author = {google},
  title = {mantis-structural-index security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/google-mantis-structural-index/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-structural-index security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-structural-index/audits/1"
identifiers:
  - type: other
    value: "skillstore:google-mantis-structural-index:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Navigate an Unfamiliar Codebase

Build source cross-references, resolve ambiguous symbols, and locate enclosing functions before reading implementation details.

Prioritize Security Research

Rank candidate call sites with structural hints while retaining every candidate found through repository-wide lexical discovery.

Reuse Indexing Work Across Snapshots

Reuse unchanged semantic units and report coverage, provenance, and deferred work for repeated analysis runs.

Попробуйте эти промпты

Index the Current Repository

Build a local structural index for the current repository. Use unknown snapshot provenance, report coverage and backend precision, and preserve source files.

Resolve a Symbol and Its Callers

Resolve [symbol name] in [language or file]. Ask me to disambiguate matches, then list paginated caller hints with precision and coverage. Include lexical candidates.

Index a Pinned Snapshot

Index [snapshot root] using [snapshot ID] and [state root]. Verify provenance, reuse matching units, keep the snapshot read-only, and report deferred partitions.

Plan a Large Incremental Build

Index [snapshot root] locally with approved backends and verified helpers. Prioritize [target files] and changed units within [unit and byte limits]. Report reuse, remaining work, and coverage without excluding lexical candidates.

Лучшие практики

Validate snapshot provenance and keep generated artifacts outside pinned source trees.
Verify helper integrity before execution and approve any remote provider before sharing repository metadata.
Inspect precision and coverage, disambiguate symbols, and combine structural results with lexical discovery.

Избегать

Treating an empty structural query as proof that no callers exist.
Reusing an unknown-snapshot index against a mutable live tree.
Executing modified helpers solely because their version comment matches.

Часто задаваемые вопросы

Does this skill include executable indexing scripts?

No. The supplied file defines instructions and contracts. The agent generates builder and query helpers at runtime.

Can it run without a pinned snapshot?

Yes. It indexes the current directory with unknown provenance and rebuilds on every invocation.

Which indexing backends can it use?

It selects available backends per partition, including matched native indexes, compiler extractors, AST parsers, symbol tools, heuristics, and lexical fallback.

Does it replace repository-wide lexical searches?

No. Structural results are advisory. Consumers must retain lexical candidates and combine both result sets.

Can it analyze vulnerabilities or generate patches?

No. Its scope is source cross-reference data. Findings analysis, patching, reporting, and production build reachability are outside its scope.

Does it send repository information to remote services?

Local indexing does not require a remote provider. Optional remote queries can disclose symbol and file metadata; approve the destination before enabling them.

Сведения для разработчиков

Автор

google

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/google/mantis/tree/f48a85e8823ee6f4824ae9a24b9b2efb8aab8c9a/mantis-structural-index

Ссылка

0bd3c12a7023af664e0537d6e6f74414f1b538f3

Актуальность поддержки

05.10.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md