# Ghost Security AppSec Skills > Lets your agent find vulnerabilities in your code, prove they're real against your running app, and fix them: SCA, secrets, SAST and DAST. Ghost Security's open-source application security skills for your coding agent. Deterministic scanners find the candidates, and the skills add a security engineer's judgment on top: is this dependency flaw reachable, is this string a real leaked key, can this finding actually be exploited. It follows a find, validate, fix loop, and every finding comes with context and a fix your agent can apply. What you can do with it - Build a shared picture of your repository: its structure, business criticality, sensitive data and components - Check dependency vulnerabilities for real exploitability (SCA), using the OSV database - Scan for leaked secrets and credentials, and judge whether each match is real - Run AI code analysis across 102 vulnerability types (SAST) - Combine every scan into one prioritized security report - Validate individual findings, including live tests against your running application (DAST) through a local proxy The skills - ghost-repo-context, ghost-scan-deps, ghost-scan-secrets, ghost-scan-code, ghost-report, ghost-validate and ghost-proxy - They drive Ghost's open-source tools: Poltergeist (secret scanner), Wraith (dependency scanner), Reaper (HTTPS proxy for live validation) and Exorcist (code analysis) How it works - Install the ghost plugin from Ghost Security's own marketplace: claude plugin marketplace add ghostsecurity/skills, then claude plugin install ghost@ghost-security. - Run /ghost-repo-context first, then the three scans, then /ghost-report and /ghost-validate. - The skills download the latest tool binaries the first time they run. Good to know - Results stay on your machine under ~/.ghost; only Wraith's vulnerability lookups go out to the OSV database. - Live validation sends traffic to the application you point it at, so use it on apps you're allowed to test. - Apache 2.0 licensed. The same marketplace also offers a separate exo plugin for Ghost's agent platform. - Type: Skill - Made by: ghostsecurity - Category: Security - Formats: Skills, Claude plugins - Version: latest - Source: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost - Page: https://pluginboard.ai/skills/ghost-security-appsec-skills ## Works with - ChatGPT - Claude - Gemini - GitHub Copilot - Cursor - Claude Code - Codex - Antigravity - Gemini CLI - Replit - OpenClaw - OpenCode - Hermes Agent ## Install ### ChatGPT In ChatGPT: Download the ghost folder and zip it, then Plugins → Skills → Create → Upload from your computer. Business and Enterprise plans. View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Claude In Claude (web or desktop): Download each skill’s folder and zip it, then upload them one at a time in Customize → Skills. View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Gemini In Gemini: Download the ghost folder, then at gemini.google.com click Customize → Skills → Create → Upload and pick the folder (or a .zip of it). View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### GitHub Copilot Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.copilot/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.copilot/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.copilot/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.copilot/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.copilot/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.copilot/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.copilot/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Cursor Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.cursor/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.cursor/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.cursor/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.cursor/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.cursor/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.cursor/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.cursor/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Claude Code In Claude Code, as a plugin: ```text /plugin marketplace add ghostsecurity/skills /plugin install ghost@ghost-security ``` Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.claude/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.claude/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.claude/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.claude/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.claude/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.claude/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.claude/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Codex Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.agents/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.agents/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.agents/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.agents/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.agents/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.agents/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.agents/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Antigravity In Antigravity: Copy the ghost folder into ~/.gemini/config/skills (Antigravity app and IDE) or ~/.gemini/antigravity-cli/skills (Antigravity CLI). View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Gemini CLI Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.gemini/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.gemini/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.gemini/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.gemini/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.gemini/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.gemini/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.gemini/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Replit Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy .agents/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context .agents/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report .agents/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code .agents/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps .agents/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets .agents/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate .agents/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### OpenClaw Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.openclaw/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.openclaw/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.openclaw/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.openclaw/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.openclaw/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.openclaw/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.openclaw/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### OpenCode Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.config/opencode/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.config/opencode/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.config/opencode/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.config/opencode/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.config/opencode/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.config/opencode/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.config/opencode/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost ### Hermes Agent Copy all 7 skills, in your terminal: ```shell npx -y degit ghostsecurity/skills/plugins/ghost/skills/proxy ~/.hermes/skills/proxy npx -y degit ghostsecurity/skills/plugins/ghost/skills/repo-context ~/.hermes/skills/repo-context npx -y degit ghostsecurity/skills/plugins/ghost/skills/report ~/.hermes/skills/report npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-code ~/.hermes/skills/scan-code npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-deps ~/.hermes/skills/scan-deps npx -y degit ghostsecurity/skills/plugins/ghost/skills/scan-secrets ~/.hermes/skills/scan-secrets npx -y degit ghostsecurity/skills/plugins/ghost/skills/validate ~/.hermes/skills/validate ``` View the skills on GitHub: https://github.com/ghostsecurity/skills/tree/HEAD/plugins/ghost --- From Pluginboard (https://pluginboard.ai).