Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Use astgrepscan, sourcesinkscan, and smtcheckreachability (mantisprogramanalysis MCP server) to move a candidate toward a proven-reachable finding
Install Program Analysis
$ npx skills add deonmenezes/mantishack --skill program-analysis -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install deonmenezes/mantishack program-analysis --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/deonmenezes/mantishack.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.codex/skills/program-analysis .claude/skills/program-analysis && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "program-analysis" agent skill from https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysis into .claude/skills/program-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "program-analysis", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysisType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add deonmenezes/mantishack --skill program-analysis -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install deonmenezes/mantishack program-analysis --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/deonmenezes/mantishack.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.codex/skills/program-analysis .agents/skills/program-analysis && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "program-analysis" agent skill from https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysis into .agents/skills/program-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "program-analysis", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add deonmenezes/mantishack --skill program-analysis -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install deonmenezes/mantishack program-analysis --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/deonmenezes/mantishack.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.codex/skills/program-analysis .cursor/skills/program-analysis && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "program-analysis" agent skill from https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysis into .cursor/skills/program-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "program-analysis", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/deonmenezes/mantishack.git --path .codex/skills/program-analysis--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add deonmenezes/mantishack --skill program-analysis -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install deonmenezes/mantishack program-analysis --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/deonmenezes/mantishack.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.codex/skills/program-analysis .gemini/skills/program-analysis && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "program-analysis" agent skill from https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysis into .gemini/skills/program-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "program-analysis", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install deonmenezes/mantishack program-analysisInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add deonmenezes/mantishack --skill program-analysis -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/deonmenezes/mantishack.git skills-src && mkdir -p .github/skills && cp -r skills-src/.codex/skills/program-analysis .github/skills/program-analysis && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "program-analysis" agent skill from https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysis into .github/skills/program-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "program-analysis", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add deonmenezes/mantishack --skill program-analysis -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install deonmenezes/mantishack program-analysis --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/deonmenezes/mantishack.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.codex/skills/program-analysis .opencode/skills/program-analysis && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "program-analysis" agent skill from https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/program-analysis into .opencode/skills/program-analysis/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "program-analysis", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
program-analysis- GitHub stars
- 505
- Token cost
- ~551 tokens
- SKILL.md length
- 283 words
- Files
- 1
- Skills in repo
- 11
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Use astgrepscan, sourcesinkscan, and smtcheckreachability (mantisprogramanalysis MCP server) to move a candidate toward a proven-reachable finding
- Security work in your project
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Program Analysis is an agent skill from deonmenezes/mantishack. Use astgrepscan, sourcesinkscan, and smtcheckreachability (mantisprogramanalysis MCP server) to move a candidate toward a proven-reachable finding
Its SKILL.md is about 550 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security. It works with Model Context Protocol. The licence is Apache-2.0.
When your agent uses it
- Security work in your project
Example prompts
- “/program-analysis”
What it can do on your machine
Read from SKILL.md and the folder at commit c3a2e68. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Program Analysis loads about 551 tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 283 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from deonmenezes/mantishack at commit c3a2e68, republished under its Apache-2.0 licence (© deonmenezes). 283 words, ~551 tokens.
Download SKILL.mdSave it as
.claude/skills/program-analysis/SKILL.md (or your agent's skills folder).- name
- program-analysis
- description
- Use ast_grep_scan, source_sink_scan, and smt_check_reachability (mantis_program_analysis MCP server) to move a candidate toward a proven-reachable finding
The mantis_program_analysis MCP server is the program-analysis substrate (PRD FR-3.1/3.2/3.3): it doesn't find vulnerabilities by itself, it gives you the primitives to prove or disprove reachability for candidates surfaced elsewhere (semgrep, CodeQL, manual reading).
Three tools, three different jobs:
source_sink_scan: fast, dependency-free regex proxy for attacker-controlled-input sources (req.query,request.args,os.Args, ...) and dangerous sinks (eval,exec,innerHTML,pickle.loads, ...) across JS/TS, Python, Go, and Java. This is a recall tool, not proof -- it will surface sources and sinks in the same file or project without knowing if they're actually connected. Use it to cheaply widen your candidate list early in Recon/Detect, then manually trace whether a specific source really flows to a specific sink.ast_grep_scan: precise structural search when you need to find every call site of a specific pattern (e.g.exec($CMD, $CB)) with real AST semantics instead of regex guessing. Use this to enumerate all call sites of a sink once you've picked a vulnerability class to chase, or to confirm a source-sink pair you suspect fromsource_sink_scanactually appears in the same statement/scope.smt_check_reachability: once you've traced a concrete path from source to sink and can express the path condition (e.g. "sink fires whencmdis attacker-controlled and no allowlist check occurred on that branch") as SMT-LIB2 constraints, hand it to z3.satmeans an attacker-controlled assignment exists that reaches the sink -- move the candidate to Validate.unsatmeans the path is provably unreachable under those constraints -- reject it and cite the unsat result as the roadblock.unknownproves nothing either way; don't treat it as a pass.
None of these three tools replace attacker-simulation validation -- they narrow candidates and prove/disprove reachability so validation time is spent on things that can actually matter.
© deonmenezes, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .codex/skills/program-analysis of deonmenezes/mantishack.
Open the folder on GitHubat commit c3a2e68
Compare with similar skills
Program Analysis next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Program Analysis this skilldeonmenezes/mantishack | 505 | — | ~551 | Automated safety check: Pass | Apache-2.0 | |
| Forensifyalexgreensh/repo-forensics | 187 | — | ~2.5k | Automated safety check: Notes | Custom licence | |
| Plugin Scanneriflytek/skillhub | 5.2k | 2 repos | ~1.1k | Automated safety check: Notes | Apache-2.0 | |
| Agent Security AuditOWASP/secure-agent-playbook | 186 | — | ~542 | Automated safety check: Pass | CC-BY-4.0 | |
| Webcrypt MCPputervision/state-memory-mcp | 111 | — | ~847 | Automated safety check: Pass | MIT | |
| Security Passcyanheads/pubmed-mcp-server | 154 | — | ~6.4k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Plugin Scanner
iflytek/skillhub
Scan AI agent skills, plugins, MCP servers, and agent tooling for prompt injection, unsafe commands, secret exposure, and supply-chain risks before installing or trusting them.
Agent Security Audit
OWASP/secure-agent-playbook
Audit AI agent configurations for security risks — excessive permissions, prompt injection surfaces, data exfiltration paths, and missing guardrails.
Webcrypt MCP
putervision/state-memory-mcp
Teaches the agent to use the WebCrypt MCP server for AES-256-GCM symmetric encryption, RSA-4096 hybrid encryption, key generation, digital signatures, hashing, and post-quantum cryptography.
Security Pass
cyanheads/pubmed-mcp-server
Review an MCP server for common security gaps: LLM-facing surfaces as injection vector (tools, resources, prompts, descriptions), scope blast radius, destructive ops without consent, upstream auth…
MCP Gateway Security
Hack23/cia
MCP gateway security patterns, token management, request validation, and audit logging for MCP communications
More from deonmenezes/mantishack
All 11 skills in this repoCodex Issue Digest
deonmenezes/mantishack
Run a GitHub issue digest for openai/codex by feature-area labels, all areas, and configurable time windows.
Codex Bug
deonmenezes/mantishack
Diagnose GitHub bug reports in openai/codex. An agent skill from deonmenezes/mantishack.
Detection Breadth
deonmenezes/mantishack
When and how to reach for the companion detectors -- bandit (Python SAST) and trivy (deps + secrets + IaC misconfig) -- alongside the core semgrep/CodeQL/osv/trufflehog toolchain
HTTP Evidence
deonmenezes/mantishack
Turn a captured HTTP request/response into a bounded, redacted evidence pack with a stable request-ref using the mantishttpaudit MCP server, instead of pasting raw traffic into a finding
Canary Tripwire Response
deonmenezes/mantishack
What to do if a mantiscanary decoy tool ever shows up as tempting or gets called -- treat it as a security incident, not a normal tool result
Codeql Audit
deonmenezes/mantishack
Build a CodeQL database and run dataflow-backed query-suite analysis via the mantiscodeql MCP server
Related
Works with
Categories
Questions about Program Analysis
What does Program Analysis do?
Use astgrepscan, sourcesinkscan, and smtcheckreachability (mantisprogramanalysis MCP server) to move a candidate toward a proven-reachable finding. Program Analysis is an agent skill from deonmenezes/mantishack.
When should I use Program Analysis?
Program Analysis fits situations like: security work in your project.
How do I install Program Analysis in Claude Code?
Run `npx skills add deonmenezes/mantishack --skill program-analysis -a claude-code`. Or copy the skill folder (.codex/skills/program-analysis in deonmenezes/mantishack) into .claude/skills/program-analysis in your project. Claude Code loads it when a task matches its description.
How do I install Program Analysis in Codex?
Run `npx skills add deonmenezes/mantishack --skill program-analysis -a codex`. Or copy the skill folder (.codex/skills/program-analysis in deonmenezes/mantishack) into .agents/skills/program-analysis in your project. Codex loads it when a task matches its description.
Can I use Program Analysis in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add deonmenezes/mantishack --skill program-analysis -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/program-analysis, .gemini/skills/program-analysis, .github/skills/program-analysis and .opencode/skills/program-analysis in your project.
What does Program Analysis need to run?
SKILL.md names no scripts, command-line tools or credentials: Program Analysis is instructions for the agent only.
Does Program Analysis access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Program Analysis safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Program Analysis use?
Program Analysis is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Program Analysis use?
About 551 tokens (SKILL.md is roughly 2.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Program Analysis?
Skills that share tags, products or a category with Program Analysis: Forensify (alexgreensh/repo-forensics, 187 stars), Plugin Scanner (iflytek/skillhub, 5.2k stars), Agent Security Audit (OWASP/secure-agent-playbook, 186 stars) and Webcrypt MCP (putervision/state-memory-mcp, 111 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Program Analysis?
deonmenezes (a GitHub user) maintains it in deonmenezes/mantishack, which has 505 GitHub stars. The repository holds 11 skills in this directory. The repository was last updated on October 3, 2026.
Source: deonmenezes/mantishack on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.