Lets your agent find vulnerabilities in your code, prove they're real against your running app, and fix them: SCA, secrets, SAST and DAST.
Pack · 7 skillsby
4 images
About
Ghost Security's open-source application security skills for your coding agent. Deterministic scanners find the candidates, and the skills add a security engineer's judgment on top: is this dependency flaw reachable, is this string a real leaked key, can this finding actually be exploited. It follows a find, validate, fix loop, and every finding comes with context and a fix your agent can apply. What you can do with it - Build a shared picture of your repository: its structure, business criticality, sensitive data and components - Check dependency vulnerabilities for real exploitability (SCA), using the OSV database - Scan for leaked secrets and credentials, and judge whether each match is real - Run AI code analysis across 102 vulnerability types (SAST) - Combine every scan into one prioritized security report - Validate individual findings, including live tests against your running application (DAST) through a local proxy The skills - ghost-repo-context, ghost-scan-deps, ghost-scan-secrets, ghost-scan-code, ghost-report, ghost-validate and ghost-proxy - They drive Ghost's open-source tools: Poltergeist (secret scanner), Wraith (dependency scanner), Reaper (HTTPS proxy for live validation) and Exorcist (code analysis) How it works - Install the ghost plugin from Ghost Security's own marketplace: claude plugin marketplace add ghostsecurity/skills, then claude plugin install ghost@ghost-security. - Run /ghost-repo-context first, then the three scans, then /ghost-report and /ghost-validate. - The skills download the latest tool binaries the first time they run. Good to know - Results stay on your machine under ~/.ghost; only Wraith's vulnerability lookups go out to the OSV database. - Live validation sends traffic to the application you point it at, so use it on apps you're allowed to test. - Apache 2.0 licensed. The same marketplace also offers a separate exo plugin for Ghost's agent platform.
Once it’s added
“Build the security context for this repo”
“Which of our vulnerable dependencies are actually exploitable?”
“Scan this repo for leaked secrets and tell me which are real”
“Scan the code for security issues”
“Give me one prioritized security report across all the scans”
“Validate this SQL injection finding against my local app”
Before you add it
Reads only
Your repository's code, dependencies and config · Vulnerability data from the OSV database · Traffic between a client and your app, through the Reaper proxy
Makes changes · your agent can ask first
Scan results and reports under ~/.ghost · Code fixes, when you ask your agent to apply them · Live test requests to the app you choose to validate against
Pack · 7 skills, each with its own page
From people who use it
Step by step
No reviews yet. Used Ghost Security AppSec Skills? Say how it went.
Write a reviewRuns on your machine.
Runs on your machine.
Runs on your machine.
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.copilot/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.copilot/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.copilot/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.copilot/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.copilot/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.copilot/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.copilot/skills/validate
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.cursor/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.cursor/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.cursor/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.cursor/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.cursor/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.cursor/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.cursor/skills/validate
Runs on your machine.
/plugin marketplace add ghostsecurity/skills /plugin install ghost@ghost-security
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.claude/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.claude/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.claude/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.claude/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.claude/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.claude/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.claude/skills/validate
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.agents/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.agents/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.agents/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.agents/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.agents/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.agents/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.agents/skills/validate
Runs on your machine.
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.gemini/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.gemini/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.gemini/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.gemini/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.gemini/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.gemini/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.gemini/skills/validate
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy .agents/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context .agents/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report .agents/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code .agents/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps .agents/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets .agents/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate .agents/skills/validate
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.openclaw/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.openclaw/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.openclaw/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.openclaw/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.openclaw/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.openclaw/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.openclaw/skills/validate
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.config/opencode/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.config/opencode/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.config/opencode/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.config/opencode/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.config/opencode/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.config/opencode/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.config/opencode/skills/validate
Runs on your machine.
npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.hermes/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.hermes/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.hermes/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.hermes/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.hermes/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.hermes/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.hermes/skills/validate
Scanned and passed · checked 49 min ago
Skills people install alongside Ghost Security AppSec Skills.
Nothing new reaches your agent until a person has looked at it.
Scanned on every change, and again when our rules improve.
GeminiSupported
GitHub CopilotSupportedTell us and a person on the trust team will look at it. Or email [email protected].
Nobody has shared how they use Ghost Security AppSec Skills yet.
Security scan
Passed
Safe to install in every agent it supports. Runs in your agent, as instructions.
Skills people install alongside Ghost Security AppSec Skills.
Trail of Bits' skills for fuzzing and crypto testing, from its Testing Handbook: libFuzzer, AFL++, cargo-fuzz, Atheris, OSS-Fuzz and more.
Has your agent diff two Windows builds with WinDiff and explain what changed in syscalls, symbols and mitigations, and why it matters.
