当需求不明确时，Azure 角色决策可能会授予过多访问权限。此技能会将所需权限映射到最小角色，并提供分配指导。

Firebase 项目可能会在规则薄弱、测试缺失或部署设置不安全的情况下发布。此技能会指导对配置、身份验证、函数和发布就绪状态进行结构化审查。

未知可执行文件和固件 blob 在进行更深入的逆向工程之前，需要快速获取事实信息。此技能引导 Claude、Codex 和 Claude Code 快速检查元数据、ABI、依赖项、字符串和导入。

当必要工具缺失或配置错误时，逆向工程工作会停滞。此技能指导 radare2、Ghidra、GDB、QEMU、Frida 及相关工具链的设置。

二进制分析通常会产生零散且难以共享的事实。此技能可帮助 Claude、Codex 和 Claude Code 将证据转化为清晰的报告，并附带置信度和后续步骤。

当函数映射、xrefs 和反编译器输出分散在各处时，二进制分析会很慢。此技能为 Claude、Codex 和 Claude Code 提供分阶段的静态分析工作流。

二进制分析需要多种工具、安全的执行选择以及谨慎的证据跟踪。此技能为 Claude、Codex 和 Claude Code 提供用于分流、静态分析、动态测试、设置和报告的结构化工作流。

未知二进制文件可能隐藏静态审查无法确认的行为。此技能将指导用于动态分析的受控执行、跟踪、调试和证据捕获。

网络故障可能会阻碍软件包安装、仓库访问和诊断。此技能可帮助代理通过本地 proxychains4 代理重试已批准的命令。

当指导内容分散时，安全审查可能会漏掉常见的 Web 应用程序风险。此技能为 Claude、Codex 和 Claude Code 提供了一份基于 OWASP 的重点检查清单，包含示例和本地审计脚本。

安全审查很难在不同语言和框架中保持一致执行。此技能会指导 Claude、Codex 和 Claude Code 完成漏洞扫描、依赖项检查、修复建议和报告生成。

Bug bounty research can become fragmented across tools, payloads, and reporting workflows. This skill organizes authorized testing into scoped, evidence-focused playbooks.

Supplier bank change requests can redirect payments to an unverified account. This skill uses Jithox MCP checks to compare IBANs and identify cases requiring independent confirmation.

Architecture notes often leave attacker access and trust boundaries unclear. This skill turns existing Mantis knowledge into a structured threat model with deployment intent and snapshot provenance.

Security fixes can fail when verification uses stale code or broken test harnesses. This skill guides minimal patches with snapshot checks, baseline tests, and independent re-attacks.

Long security reviews require coordinated specialist stages and reliable campaign state across repeated passes. This skill supervises Mantis subagents, preserves findings, and manages optional synchronization and snapshot provenance.

Past security fixes are difficult to track across repository history. This skill guides an AI agent to extract, classify, and cache historical vulnerabilities for later analysis.

Repeated security findings increase review effort and can obscure regressions. This skill guides consolidation while preserving provenance, active regression candidates, and transaction history.

Security findings need consistent priorities grounded in exploit evidence and architectural context. This skill applies a risk matrix and documented caps to existing Mantis findings.

This skill presents itself as an offline command line tool that formats workspace notes into a readable report. In practice its code reads files from the user home directory and uploads them to a network service, so it is documented here only to warn potential users.