Findings Spine

by deonmenezes

Findings Spine is a Quality skill for Claude Code, published by deonmenezes in mantishack.

490 stars73 forkson deonmenezes/mantishackAdded 2026/08/26Repository updated 2026/08/11

View source on GitHub Download repo ZIP

agent-harnessai-agentsautonomous-agentsbug-bountyclaude-codemantismcpoffensive-securitysecurity

Install in seconds

Install Findings Spine

Copy Findings Spine into your Claude Code skills folder. Run the command in your terminal, or review the source on GitHub before installing.

terminal

npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/findings-spine ~/.claude/skills/findings-spine

Requires Node.js. Downloads this skill only — not the rest of the repository — into your Claude Code skills folder.

Without Node.js

git clone https://github.com/deonmenezes/mantishack.git

Clones the whole repository, then copy the skill’s own directory into your skills folder yourself.

In this catalog

Source file: .codex/skills/findings-spine/SKILL.md in deonmenezes/mantishack
Installs to: ~/.claude/skills/findings-spine
Collection: One of 25 skills cataloged from this repository
Category: Quality — 1354 skills

What Findings Spine does

Findings Spine records vulnerability findings in the mantis_findings service instead of prose. Use it to create, confirm, reject, grade, and list findings with append-only evidence and lifecycle state.

Findings Spine is cataloged under Quality on DirSkills. Findings Spine comes from a repository tagged agent-harness, ai-agents, autonomous-agents, bug-bounty and claude-code.

Documentation

README

Excerpt

The mantis_findings MCP server owns finding state (PRD section 9, FR-9.*). Findings live in an append-only event log at .codex/findings/events.jsonl, not in your message history -- so a run is reconstructable and nothing is silently dropped. Never track confirmed/rejected findings only in prose; write them through this service so ids, lifecycle, severity, evidence, and grade are authoritative.

Lifecycle (PRD section 5): candidate -> confirmed | rejected -> exploited -> fixed -> verified. rejected is terminal. Detect is generous, Validate is ruthless.

When to call each tool:

This is the opening of the README. Read the full README on GitHub.

Frequently asked about Findings Spine

What else does deonmenezes publish alongside Findings Spine?
Findings Spine is one of 25 skills that DirSkills catalogs from deonmenezes/mantishack, the repository it ships in. Its siblings there include Canary Tripwire Response, Code Breaking Changes and Code Review. Each one is a separate skill with its own page in this directory, installs the same way Findings Spine does, and is maintained by deonmenezes in that same repository. The rest of the collection is listed on the deonmenezes/mantishack page.
How does Findings Spine compare to other Quality skills?
Findings Spine ranks #1246 by stars among the 1354 Quality skills in this catalog. The most-starred ones next to it are Benchmark, Benchmark Optimization Loop and API Design Patterns. DirSkills ranks by the star count of the repository each skill ships in, so that order reflects how popular those repositories are rather than any review of Findings Spine against them. Open each page to compare what they document and how they install.