google/mantis is a modular set of security-review skills that coding agents use to find, reproduce, and patch software vulnerabilities. It is for adapting automated security testing to application, infrastructure, machine-learning, hardware, and firmware projects, with expert review required for results. The catalogue skills and instruction provide the workflow for using Mantis with coding agents.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/google/mantisnpx agentmods add skills/google/mantis/mantis-patchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/google/mantis/mantis-patch)<a href="https://agentmods.dev/skills/google/mantis/mantis-patch"><img src="https://agentmods.dev/badge/skills/google/mantis/mantis-patch/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/google/mantis/mantis-patch"><img src="https://agentmods.dev/badge/skills/google/mantis/mantis-patch.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk warn
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.10940 |
| Opus 5.5 | $0.00021 | $0.04376 |
| Sonnet 5.5 | $0.00010 | $0.02188 |
| Haiku 4.5 | $0.00005 | $0.01094 |
Grade B, and why
mantis-patch scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
completely (e.g., `rm -rf <shadow_directory>`). Since the original Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 774 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Patcher (/mantis-patch)
System Goal
Security Patching Expert. Generates minimal, correct code fixes, applies them to source code files, and verifies them inside isolated sandboxes before appending logs to long-term memory.
Command Definition
- Command:
/mantis-patch [--target_root=<path>] [--state_root=<path>] [--snapshot_root=<path>] [--snapshot_id=<id>] [--snapshot_pinned=<true|false>] - Description: Generates minimal security fixes using transactional isolation (shadow directories or file backups), applies patches, and verifies them.
- Parameters (all optional; absent ⇒ today's behavior):
--target_root: Root of the code snapshot to read (CODE_ROOT). When the orchestrator pins a snapshot it passes--snapshot_root;--target_rootis reserved for a caller that hands you an already-prepared tree.--snapshot_root: Root of the pinned immutable snapshot for this pass.--snapshot_id: The SNAPSHOT_ID string of the pinned snapshot (used by the Snapshot Match Check).--snapshot_pinned:truewhen a pinned immutable snapshot exists this pass;false/absent ⇒ degraded/legacy (see Backward-compat).--state_root: Root of the Mantis state directory that containsworkspace/(defaults to the current directory). ALLworkspace/...paths in this file are STATE-RELATIVE and resolve under<state_root>/workspace/....
Input/Output Contract
- Reads:
workspace/findings/(reproduced finding JSON files wherepatch_statusis not"VERIFIED_SECURE"or"MITIGATION_PROPOSED").workspace/.mantis_state.json(to track current loop pass).workspace/.mantis_state.jsonactive_snapshot(root,snapshot_id,snapshot_pinned) — resolved via Block A; supplies CODE_ROOT and the SNAPSHOT_ID used by the Snapshot Match Check when no--snapshot_*flag is passed.- Target source code files.
- Reproducer script path (
repro_file_path) and command (run_command) from findings. - Pre-existing backup files matching finding ID (if Option B is used).
- Writes:
- Source code modifications (applied transactionally and rolled back).
- Updates finding JSON files in-place (sets
"patch_status","patch_diff", re-attack details including"reattack_status"and"reattack_variants", and history). - Appends to
workspace/learnings.jsonl. - Reusable helper script
workspace/helpers/append_patch.py.
- Preconditions:
- Findings must exist in
workspace/findings/.
- Findings must exist in
- Idempotency Guarantee:
- Snapshot-aware skip: Skips a finding whose
patch_statusis already"VERIFIED_SECURE"or"MITIGATION_PROPOSED"ONLY when its recordedpatch_base_snapshotequals the current SNAPSHOT_ID (i.e. it was verified against THIS snapshot). Ifpatch_base_snapshotis absent, empty, or different from the current SNAPSHOT_ID, the terminal status is stale — do NOT skip; re-open and re-verify the finding against the current snapshot. In legacy mode (noactive_snapshotand no--snapshot_*flags) skip exactly as today (bypatch_statusalone). - Transactional isolation: modifies code inside uniquely generated temporary
directories or creates temporary file backups (
target.c.bak-[id]), restoring baseline state upon completion (usingtry...finallyrollback mechanisms). - Reuses the existing
append_patch.pyscript once created.
- Snapshot-aware skip: Skips a finding whose
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 774 lines · 52 tokens per session scan B c14701e02eb6
mantis-patch is a skill published in the GitHub repository google/mantis (2,525 stars, last pushed today), licensed Apache-2.0. It adds 52 tokens to every session and 10,940 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
reverse-engineer-anything
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA, and build agent environments (AgentEnv bundles) of web applications from a live instance or a capture. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or…
error-resilience-expert
Expert guide for error handling patterns, resilience engineering, retry strategies, circuit breakers, and graceful degradation across React, Next.js, and Node.js / Panduan ahli pola penanganan error, rekayasa ketahanan, strategi retry, circuit breaker, dan degradasi anggun di React, Next.js, dan Node.js.
dependency-upgrade-migrator
Expert guide for dependency upgrades, breaking change migrations, codemod automation, and package audit remediation / Panduan ahli untuk upgrade dependensi, migrasi breaking change, otomasi codemod, dan remediasi audit paket.
logging-error-tracking-expert
Expert guide for structured logging (Pino, Winston), error tracking (Sentry), log aggregation (Axiom, Datadog), request correlation, and GDPR-compliant log management / Panduan ahli untuk logging terstruktur (Pino, Winston), pelacakan error (Sentry), agregasi log, korelasi request, dan manajemen log sesuai GDPR.
app-analyzer-optimizer
Deeply analyzes application architecture and structure to perform audit, bottleneck detection, and code/performance optimization / Mempelajari arsitektur dan struktur aplikasi secara mendalam untuk melakukan audit, deteksi bottleneck, serta optimasi performa dan kode.
autonomous-tdd-debugger
Empowers the agent to autonomously run tests, read terminal stack traces, and self-heal code until tests pass. Transforms the agent from a passive coder to an active CI pipeline debugger.