菜单
Consolidates raw security findings to eliminate redundant reports. Use when raw findings have been generated by the researcher and need consolidation before review. Don't use for initial code auditing or patch generation.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Synthesizes raw learnings and codebase analysis into an interlinked Markdown Knowledge Base (KB). Use at the beginning of a loop to build or update architecture.md, entities, and vulnerabilities. Don't use for generating threat models or formulating execution plans.
Calculates the final risk score based on empirical evidence and architectural impact. Use when findings have been fully processed by previous stages and you need to append final risk scores to the finding files. Don't use for discovering new vulnerabilities or writing patches.
Synthesizes trust boundaries, attack surfaces, and attacker profiles into a living threat model. Use as Stage B of the Knowledge Base generation process, reading architecture and entity definitions from the KB. Don't use for analyzing source code or extracting raw learnings from JSONL files.
Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for initial codebase auditing or writing patch code.
Audits production source code files based on the strategy in plan.json. Use when a review plan exists and you need to perform static analysis and deep-dive reviews of targeted files. Don't use for planning, deduplicating, or writing patches.
Assesses the production viability of findings, filtering out debug-only features and assertion traps. Use when findings have been validated and you need to confirm they are triggerable in production release builds (with assertions disabled). Don't use for writing reproduction scripts or patches.
| name | mantis_dedupe |
| description | Consolidates raw security findings to eliminate redundant reports. Use when raw findings have been generated by the researcher and need consolidation before review. Don't use for initial code auditing or patch generation. |
Duplicate Finding Merger. Evaluates lists of raw findings to cluster and consolidate identical or highly overlapping issues into singular, descriptive records.
/mantis_dedupeReview a list of security findings and merge duplicate findings that refer to the exact same security flaw or adjacent code paths.
Execute your task as follows:
Load Raw Findings & Current Loop Queue:
workspace/findings/. If the directory is empty or does not exist,
notify the user and exit.learnings.jsonl exists in the workspace. If it does, read its
contents. This file represents findings and insights that have already
been evaluated by downstream agents (like Reviewer or Patch) within
this current loop iteration against this specific version of the
codebase.historical_learnings.jsonl (VCS history), as we want to catch
regressions if old bugs were reintroduced.Filter Loop Duplicates: Cross-reference the current findings against the
learnings.jsonl entries (using code_paths and title similarities). If
a current finding exactly matches a flaw that was already processed in this
loop (regardless of whether its status was FALSE_POSITIVE, NON_VIABLE,
SAMPLE_OR_TEST, or VERIFIED_SECURE), you must delete the new finding
file entirely and drop it from your active list. This prevents the
pipeline from getting stuck re-evaluating the same issues in the current
pass.
Filter Duplicate Findings in Current Batch: Check the current findings
against each other to find duplicates (using code_paths and title
similarities). If multiple findings refer to the exact same flaw or highly
overlapping code paths, they must be merged.
Map/Reduce Chunking Strategy (For Scale): If there are many finding files (e.g., > 20 items), use a Map/Reduce approach to group them by target file or component before checking for overlaps to avoid context window limits.
Token-Optimized Consolidation and Merging: To minimize LLM output tokens and prevent data loss, do not manually rewrite or output the merged JSON files in your response. Instead, follow this pattern:
workspace/helpers/merge_findings.py) during your first merge
action. For all subsequent merges, do not regenerate the script; simply
execute the existing helper script with the new finding IDs. The script
must follow these deterministic rules:
"id" of the primary finding being
kept.NONE > LOW > HIGH).NONE > REQUIRED)."history" entries from
the merged findings. Append a new entry to the "history" array for
this merge action, referencing the IDs of the deleted duplicate
findings that were merged into this one.workspace/findings/<primary_id>.json) on disk.Clean Up: Delete the redundant .json files of the duplicate findings
that were merged to clean up the directory and prevent redundant analysis in
downstream stages.
When complete, notify the user.