Mantis Security Review Skills
A composable security-review workflow for coding agents that investigates, reproduces, and patches vulnerabilities.
Per-dimension scores and reasoning
Evidence: README explicitly requires isolated environments, human approval, prohibits --yolo flags, and mandates manual verification of findings; data flow (KB, workspace, snapshot) is described; sensitive data (production systems, internal networks) is explicitly forbidden; external effects (executing code, writing files) have clear warnings and sandbox requirements; rollback only mentions non-destructive sync, no concrete rollback mechanism; source attribution is clear (Google official org). Deductions: dependency security only mentions gVisor etc., no dependency list or vulnerability scanning; rollback mechanism incomplete.
Evidence: README and README_AGENTS references are consistent, process description coherent; failure handling has Troubleshooting guide; dependency availability only mentions npx skills add, no version pinning or mirrors. Deductions: insufficient evidence for dependency availability.
Evidence: Clearly targets security review scenarios, supports multiple CLIs and SDKs, provides interactive and unattended deployment guides; capability boundaries (isolation, manual verification) are stated; trigger methods (slash commands) are clear; environment fit (Docker, gVisor, cloud sandboxes) has guidance. Deductions: no major flaws, but some details rely on README_AGENTS.
Evidence: README structure is clear, install instructions (npx skills add) are explicit; naming (/mantis-*) is stable; example flow and FAQ (Troubleshooting) are present; known limitations (non-determinism, hallucinations) are stated; Apache-2.0 license is complete; maintenance responsibility (not officially supported, not eligible for VRP) is clear. Deductions: version number or changelog not provided.
Evidence: Output is structured reports and patches, high usability; marginal value lies in automating security review, reducing manual repetition; cost-benefit is optimized through model tiering and interactive mode. Deductions: no execution verification, cost-benefit is inferred.
Evidence: Claims in README (e.g., isolation, manual verification) are consistent with file content; but lack independent cross-source corroboration; facts and inferences are clearly separated (e.g., explicit non-determinism). Deductions: insufficient cross-source corroboration.
- This tool is designed to generate and execute code, carrying inherent risks; must be used in isolated environments with strict human approval processes.
- AI-generated results may contain hallucinations; all findings must be manually verified by security experts before reporting.
- Dependency security information is insufficient; review dependency lists and vulnerabilities before use.
What does this agent do, and when should you use it?
Mantis is a decoupled, sequential set of security-review skills for coding agents. Its interactive slash-command workflow moves from repository structure, history, and threat modeling through scan planning, research, deduplication, review, reproduction, patching, and reporting. The workflow maintains a Markdown knowledge base and workspace learning records, and can produce security-review reports, crash reproducers, and minimal patches. By default it performs a point-in-time review of the current directory; the optional snapshot-per-pass model supports continuous review with an immutable snapshot for each pass. The project is intended for isolated, restricted environments, and every generated finding or patch requires human security-expert verification.
Users can run /mantis-history to analyze version-control history, /mantis-structural-index to build a content-addressed semantic-unit index, /mantis-summarize to create directory maps, and /mantis-architecture to synthesize repository knowledge into workspace/kb/. /mantis-threat-model, /mantis-plan, and /mantis-researcher then develop a threat model, map a scanning roadmap, and conduct the flaw sweep; /mantis-dedupe, /mantis-review, and /mantis-critic consolidate findings, validate code, and filter false positives. For surviving issues, /mantis-reproduce creates and runs crash reproducers in sandboxes, /mantis-chain combines validated findings into multi-step exploit chains, and /mantis-patch applies minimal fixes and checks whether they block the reproducer. /mantis-calibrate adds risk ratings, /mantis-reflect appends execution insights, and /mantis-report creates a human-readable security review packet.
- An application-security team wants a staged vulnerability-discovery process for a repository before human review.
- A maintainer needs a coding agent to generate a crash reproducer and verify that a minimal patch prevents it.
- A team reviewing Hardware/RTL, infrastructure as code, ML pipelines, or compiled firmware wants to adapt the skills to its domain.
- A security team reviewing a changing codebase wants optional pass-level immutable snapshots and non-destructive synchronization only between passes.
- A reviewer wants scanning plans and threat models to incorporate repository history, structural knowledge, and accumulated workflow learnings.
What are this agent's strengths and limitations?
- Covers the path from repository knowledge and threat modeling through reproducer validation, patch verification, and a final review packet rather than stopping at scan alerts.
- Uses decoupled stages that can include optional history analysis, structural indexing, and directory summaries, and can be adapted to software or hardware domains.
- Offers both point-in-time review and an opt-in snapshot-per-pass continuous model that stamps findings against the snapshot used for discovery.
- Explicitly directs reproducer execution toward isolated containers and emphasizes human approval and expert verification.
- Models are non-deterministic and can produce false positives, incorrect patches, or unsafe actions; security experts must manually verify every finding.
- Reproduction and patching may generate and execute unexpected code, requiring isolated restricted environments and additional hardening for unattended operation.
- Users must supply a coding-agent CLI and tailor the surrounding environment, internal documentation, coding standards, and build systems to their target.
- The project is documented as a demonstration project, not for production use, and is outside the Google Open Source Software Vulnerability Rewards Program.
How do you install or deploy this agent?
From an environment with a configured coding-agent CLI, run: npx skills add google/mantis. Then start that coding agent in the workspace you want to review. The documentation does not require a specific model, credential, or exclusive runtime; Docker, gVisor (runsc), and relevant cloud SDKs are presented as optional setup choices.
How do you use this agent?
Begin in interactive mode and enter slash commands one at a time in the coding-agent UI; do not automatically approve sensitive actions. A basic review can start with /mantis-architecture, /mantis-threat-model, /mantis-plan, and /mantis-researcher, followed by /mantis-dedupe, /mantis-review, /mantis-critic, /mantis-reproduce, /mantis-patch, and /mantis-report. Inspect proposed file writes and execution before reproduction or patching stages. Generated scripts or code that are not being read should run only in isolated containers with networking disabled, for example with --network none.
How does this agent compare with similar options?
Mantis is not tied to one coding-agent framework. The documentation says it has been used with Gemini CLI, Antigravity CLI, Google ADK, and Antigravity SDK, while stating that other coding-agent frameworks should work.
FAQ
Can I submit its generated findings directly to maintainers?
Is it safe to run generated reproducers?
Must I use Gemini or Antigravity?
Does it continuously track code changes by default?
--sync or snapshot-related arguments.