메뉴
Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for initial codebase auditing or writing patch code.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Synthesizes raw learnings and codebase analysis into an interlinked Markdown Knowledge Base (KB). Use at the beginning of a loop to build or update architecture.md, entities, and vulnerabilities. Don't use for generating threat models or formulating execution plans.
Calculates the final risk score based on empirical evidence and architectural impact. Use when findings have been fully processed by previous stages and you need to append final risk scores to the finding files. Don't use for discovering new vulnerabilities or writing patches.
Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't use for analyzing source code or extracting raw learnings from JSONL files.
Consolidates raw security findings to eliminate redundant reports. Use when raw findings have been generated by the researcher and need consolidation before review. Don't use for initial code auditing or patch generation.
Audits production source code files based on the strategy in plan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning, deduplicating, or writing patches.
Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with assertions disabled). Don't use for writing reproduction scripts or patches.
| name | mantis_chain |
| description | Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for initial codebase auditing or writing patch code. |
Exploit Chain Architect. Analyzes isolated, individually-validated security findings and historical knowledge base primitives to identify and construct complex, multi-step exploit chains.
/mantis_chainRead the current batch of validated findings and explore whether multiple seemingly low-severity or disparate vulnerabilities can be sequentially combined to achieve a higher-impact compromise.
Execute the chaining stage as follows:
Load Primitives & Validated Findings:
workspace/findings/ directory. Filter for
findings that have passed validation (e.g., status is "VALID" or
viability is "VIABLE" or "SAMPLE_OR_TEST").workspace/kb/entities/ and
workspace/kb/vulnerabilities/) to identify architectural primitives
that might not be bugs on their own, but could serve as stepping stones
(e.g., "User controls file upload path", "Service runs as root").Cross-Finding Analysis (The Chaining Matrix):
/tmp, but a separate
misconfiguration (Finding B) allows a cron job to execute scripts in
/tmp.Construct "Super Findings":
workspace/findings/<new_uuid>.json.privileges_required field
for the chain must represent the privilege level required to initiate
the first step of the chain (the entry point). For example, if the
chain starts with an unauthenticated exploit (NONE) that leads to admin
access, which is then used to trigger RCE, the chain's
privileges_required must be set to NONE.user_interaction field
for the chain must be set to REQUIRED if the entry point or any step
in the chain requires user interaction. It should only be set to NONE
if the entire chain is zero-click.{
"id": "A unique identifier generated for this chain finding. Must match filename.",
"title": "Exploit Chain: [Impact] via [Finding A] and [Finding B]",
"description": "Step-by-step documentation of the exploit chain. Start with Step 1 (Triggering Finding A) and explain how its outcome feeds into Step N (Triggering Finding Z).",
"impact": "The combined, escalated impact of the chain (e.g., Remote Code Execution, Full Database Exfiltration). This should be higher than the individual findings.",
"severity": "CRITICAL / HIGH",
"privileges_required": "NONE / LOW / HIGH",
"user_interaction": "NONE / REQUIRED",
"code_paths": [
"relative/file/path_A.c:line_number",
"relative/file/path_B.c:line_number"
],
"mitigation": "Recommended strategy to break the chain. Usually involves fixing at least one, if not all, of the underlying links.",
"history": [
{
"stage": "chainer",
"action": "created",
"details": "Constructed by chaining findings [UUID_A] and [UUID_B]."
}
]
}
Chain Deduplication Tagging:
/mantis_dedupe treats these chains differently than raw
findings, ensure the word "Chain" is prominently featured in the
"title" and "history" fields as shown in the schema.Ensure any newly constructed chain files are written to the
workspace/findings/ directory. When complete, notify the user.