Ghost Security Skills plugin
An AppSec plugin for Claude Code: secret, dependency and code scanners plus skills that judge whether each finding is real
- 427 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The skills download and run scanner binaries on your machine
- Reaper captures an application's HTTPS traffic during live validation, and secrets from the repository reach the output and the agent's context
Install
- Works in
Manual install
claude plugin marketplace add ghostsecurity/skillsAdds the Ghost Security marketplace. Inside Claude Code, /plugin marketplace add does the same.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The skills download and run scanner binaries on your machine
- Reaper captures an application's HTTPS traffic during live validation, and secrets from the repository reach the output and the agent's context
This is third-party code. Review the repository files before installing.
What it does
The repository is Ghost Security's plugin marketplace for Claude Code. The ghost plugin adds four tools: Poltergeist hunts secrets, Wraith checks dependencies against the OSV database, Exorcist analyses code for 102 vulnerability types, and Reaper is an HTTPS proxy that captures traffic for live validation of findings. A layer of skills sits on top of the tools. A skill runs a scanner, reads the result, looks at the surrounding code and decides whether it is a real leak or a harmless match. The loop is find, validate, fix, and the agent can apply the remediation guidance itself. The skills are ghost-repo-context, ghost-scan-deps, ghost-scan-secrets, ghost-scan-code, ghost-report, ghost-validate and ghost-proxy. They install the tool binaries themselves when they run. A separate exo plugin adds the ghost-exo skill for the exo agent orchestration platform.
Who it is for. For developers and security teams who want to scan their own repository for secrets, vulnerable dependencies and code flaws straight from Claude Code.
Good fit when
- Before a release you want to check the repository for leaked keys and learn which matches are real
- You want to know which known dependency vulnerabilities are actually reachable in your code
- You want one report on secrets, dependencies and code with priorities instead of three separate dumps
- You want to confirm a finding on your own test stand: ghost-validate checks it through the code and, optionally, with live traffic
- You want the scanners on their own: Poltergeist, Wraith and Reaper work as standalone binaries
Not a fit when
- You use an agent other than Claude Code: the plugin is built for it and no other agents are named in the instructions
- You have no permission from the system owner: live validation through the Reaper proxy should run only against an application you are entitled to test
- You need a scan with no network access: the binaries download on first run and Wraith queries the OSV database
- You need a full pentest with exploitation and a client report: the plugin finds and confirms findings during development
Example request
Build the repository context, find leaked secrets and vulnerable dependencies, then put together a combined report with priorities.Limitations
The plugin ships for Claude Code, and support for other agents is not stated in the instructions. When they run, the skills download the Poltergeist, Wraith and Reaper binaries, and Wraith queries the OSV database over the network.
Scan results stay on your machine and are cached so repeat runs go faster. Rules and criteria live in YAML files that you can extend or replace.
Run live validation through the HTTPS proxy only against an application you are allowed to test. The exo plugin is for the exo platform and its MCP server connection, and the scanners do not need it. Whether the downloadable binaries are reachable from Russia was not checked for this card.
How to disable. Remove the plugins with `claude plugin uninstall ghost@ghost-security` and `claude plugin uninstall exo@ghost-security`. The scan result cache sits on your machine and can be deleted by hand.
FAQ
How do I install the Ghost Security skills in Claude Code?
Run `claude plugin marketplace add ghostsecurity/skills`, then `claude plugin install ghost@ghost-security`. Inside Claude Code the same steps are `/plugin marketplace add` and `/plugin install`. If the installer asks, run `/reload-plugins`.
In what order should I run the Ghost Security skills?
First `/ghost-repo-context` builds a shared repository context. Then come three scans: `/ghost-scan-deps`, `/ghost-scan-secrets` and `/ghost-scan-code`. After them `/ghost-report` builds the report and `/ghost-validate` checks individual findings.
What do Poltergeist, Wraith, Reaper and Exorcist do?
Poltergeist finds secrets by patterns and entropy. Wraith scans dependencies against the OSV database. Reaper is an HTTPS proxy that captures traffic during live validation. Exorcist analyses code for 102 vulnerability types. The first three ship as Go binaries through GitHub releases.
Can I use the scanners without the skills?
Yes. Poltergeist, Wraith and Reaper work as standalone binaries, and the skills only chain them into a pipeline from finding to fix. Take as much as your process needs.
Why does the repository include the exo plugin?
It adds the ghost-exo skill, which builds, improves and debugs workflows on the exo agent orchestration platform. Code scanning does not need it, so install it separately only if you work with exo.
Discussion
No questions or reviews yet.
Related
PluginsA security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
Security audit skill with GOST and FSTEC
Security Audit Skill for Claude Code
A security audit skill for Claude Code: OWASP Top 10 plus GOST R 56939, FSTEC Order No. 21 and 152-FZ, parallel subagents and a compliance matrix
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Ghost Security Skills (this entry) | yes | 427 | |
| security-audit | no | 51,777 | one Cloudflare skill for code audits, with no scanners or proxy of its own |
| Claude Code Security Reviewer | no | 6,626 | an Anthropic GitHub Action that checks pull request changes and does not cover the whole repository and dependencies |
| Mantis | yes | 2,665 | Google's skill set from threat model to patch, with no scanners for secrets and dependencies of its own |
README in short
Installation goes through the marketplace with `claude plugin` commands, and a separate page covers loading the plugin without installing it through `--plugin-dir`. Next to it sit documents on each scanner, the scan lifecycle and the architecture, plus a contributor guide.