Browse Skills

Secrets Scan runs TruffleHog through the mantis_trufflehog MCP server to find exposed credentials. Use it during secret audits and handle findings without ever revealing the raw secret.

Semgrep Triage runs Semgrep through the mantis_semgrep MCP server to detect potential issues in code. It is used to review candidates, verify reachability, and decide whether results should be confirmed or rejected.

Test TUI guides interactive use of Codex TUI to verify changes. It covers startup flags, logging, and how to send test messages for reliable debugging.

Scorecard shows a worst-first audit of CLAUDE.md rules, including which ones Claude follows, ignores, or violates. Use it to spot chronic offenders and decide which rules should become hooks or lint checks.

Agentic Actions Auditor reviews GitHub Actions workflows that invoke AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use it when auditing agentic CI workflows and cross-file references in Actions configs.

Code Explorer traces a feature through a codebase, from entry points and execution paths to supporting layers and dependencies. Use it to understand how existing code works before modifying or extending it.

Code Quality helps agents review code, run linting and type checks, and flag maintainability, complexity, and standards issues. Use it for quality gates and cleanup across Rust, TypeScript, Python, shell, and mixed repositories.

Code Review reviews a frozen set of code changes for bugs, logic errors, and convention violations. Use it when you need a PR or diff checked before merging.

Code Reviewer inspects small code changes for bugs, logic errors, security issues, and convention mismatches. Use it when reviewing a diff, a specific file, or a function and you want only high-confidence findings.

CodeQL Analysis runs CodeQL database creation, data extensions, and security queries, and can process SARIF output. Use it when CodeQL is explicitly requested or when you need deeper taint-flow security analysis.

Differential Review performs security-focused reviews of PRs, commits, and diffs. It adapts depth to codebase size, uses git history and test coverage, and produces a markdown audit report.

False Positive Check systematically verifies a suspected security bug and returns a TRUE POSITIVE or FALSE POSITIVE verdict with evidence. Use it when you need to confirm whether a reported vulnerability is actually exploitable.