技能 mantis-patch

📦

mantis-patch

Name: mantis-patch
Author: google

内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问

Generate and Verify Minimal Security Patches

Security fixes can fail when verification uses stale code or broken test harnesses. This skill guides minimal patches with snapshot checks, baseline tests, and independent re-attacks.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "mantis-patch" from https://skillstore.io/skills/google-mantis-patch.md and its manifest at https://skillstore.io/api/skills/google-mantis-patch/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/google-mantis-patch.md 已签名 manifest GET /api/skills/google-mantis-patch/manifest 已签名 lockfile GET /api/skills/google-mantis-patch/lockfile

测试它

正在使用“mantis-patch”。 Verify a bounds-check patch for an existing reproduced finding.

预期结果:

Illustrative result: Patch verification passed for the current snapshot and tested vulnerability.
The unpatched baseline triggered the issue; the patched build compiled and the benign control reached the target without crashing.
The attack and three independent variants did not trigger the original vulnerability class.
A unified diff and verification history were recorded; the original source remained unchanged.

正在使用“mantis-patch”。 Assess a reproduced firmware issue without source code.

预期结果:

Illustrative result: Mitigation proposed.
No binary modification was attempted.
Restrict access to the affected interface and pursue a vendor-supported firmware correction.
The finding record contains mitigation guidance rather than a source diff.

正在使用“mantis-patch”。 Verify a patch when independent re-attack testing times out.

预期结果:

Illustrative result: Verification incomplete.
Initial verification passed, but the independent re-attack did not complete.
No verified-secure claim was recorded; the finding remains eligible for further verification.

安全审计

高风险

v1 • 2026/10/4 打开版本化报告

All 250 static alerts are false positives: their context shows Markdown formatting, workflow metadata, temporary copies, and verification checks rather than the reported threats. Two semantic risks remain: stored reproducer commands lack required host confinement, and helper reuse relies on a forgeable version comment. No evidence found of malicious prompt injection, credential collection, or deliberate data exfiltration.

已扫描文件

825

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

SKILL.md:350-376 SKILL.md:378-396 SKILL.md:506-515

Stored Commands Lack Mandatory Host Isolation

The skill executes run_command from finding records after path substitution. Mandatory shadow copies protect source changes but do not confine process permissions or network access. If commands or reproducers are compromised, they can access host resources unless the caller supplies an additional sandbox.

Stored-command execution is explicit, while containers and namespaces are optional alternatives to source copies. Host confinement is not required; exploitation depends on compromised inputs.

高

SKILL.md:733-743

Version Marker Used To Trust Executable Helpers

Helper reuse checks its first line for MANTIS_HELPER_VERSION = 2, then instructs execution of the existing script. An attacker with helper write access can preserve that comment while replacing executable content. The version check does not establish helper integrity or provenance.

The instructions explicitly permit execution after a first-line marker check. The integrity gap is clear; exploitation requires control over the helper file.

风险因素

⚙️ 外部命令 (50)

📁 文件系统访问 (13)

SKILL.md:43 SKILL.md:44 SKILL.md:98 SKILL.md:104 SKILL.md:122 SKILL.md:124 SKILL.md:231 SKILL.md:413 SKILL.md:447 SKILL.md:470 SKILL.md:119 SKILL.md:351 SKILL.md:387

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/google-mantis-patch/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/google-mantis-patch/security.svg)](https://skillstore.io/skills/google-mantis-patch?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/google-mantis-patch?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/google-mantis-patch/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/google-mantis-patch.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

google. (2026). mantis-patch security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/google-mantis-patch/audits/1

BibTeX 引用

@techreport{google-google-mantis-patch-2026,
  author = {google},
  title = {mantis-patch security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/google-mantis-patch/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mantis-patch security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "google"
date-released: "2026-10-04"
url: "https://skillstore.io/skills/google-mantis-patch/audits/1"
identifiers:
  - type: other
    value: "skillstore:google-mantis-patch:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Remediate Reproduced Vulnerabilities

Create a minimal source fix and collect baseline, benign-control, and re-attack results for an existing reproduced finding.

Review Fixes After Source Changes

Reopen stale findings and rebase eligible archived patches onto a new snapshot before verification.

Assess Binary-Only Mitigations

Produce mitigation recommendations for firmware or compiled targets when source code is unavailable.

试试这些提示

Inspect Ready Findings

Use mantis-patch to identify eligible findings in [state_root]. Summarize required inputs and blockers without running commands or editing source.

Patch One Reproduced Finding

Patch finding [finding_id] using snapshot [snapshot_root] and state directory [state_root]. Review commands, verify helper integrity, and require a restricted execution environment.

Verify A Patch Thoroughly

Verify finding [finding_id] inside a restricted execution environment. Require baseline evidence, matching sanitizer flags, benign controls, and independent re-attacks; report missing evidence.

Rebase Archived Fixes

Review stale findings against [snapshot_root] and verify helper integrity. Rebase only eligible fixes, test in restricted environments, extract diffs, and roll back changes.

最佳实践

Review finding records and reproducer commands before execution in a restricted environment without host secrets.
Use pinned snapshots and private shadow copies to keep baseline code unchanged.
Verify complete helper content and require baseline evidence, benign controls, consistent sanitizers, and independent re-attacks.

避免

Run unreviewed commands from finding records directly on a sensitive host.
Trust an existing helper solely because its first line contains the expected version marker.
Claim verified security after missing files, failed builds, stale baselines, or incomplete re-attacks.

常见问题

What inputs does this skill require?

It requires Mantis finding records, target source or binary artifacts, and reproducer details for runnable verification.

Does it discover new vulnerabilities?

No. It targets reproduced findings and exploit-chain records rather than initial vulnerability research.

Does it leave fixes applied to the source tree?

No. It extracts patch diffs and restores the original source or removes temporary shadows after processing.

What happens when source code is unavailable?

It proposes mitigation guidance and does not attempt binary modification.

What is required for verified-secure status?

Baseline evidence, successful compilation, benign controls, consistent sanitizer settings, and independent re-attacks are required. This status does not guarantee absence of other vulnerabilities.

Are temporary shadow directories a security sandbox?

No. They isolate source changes, not host access. Use restricted execution and review stored commands and helpers.