rea
Reverse engineer anything with agents, from app behavior down to native binaries.
420k
@morlutoskills
Scans source code, dependencies and repositories for security weaknesses such as injection flaws and leaked secrets, then merges the findings into one prioritized report. It also captures and replays HTTP traffic through a proxy to help test running applications.
Plugin Signal69/100Solid
maintained77
capable46
documented100
adopted56
Auto-invoked ships a router so the right skill fires automatically as you prompt. No remembering which skill to call.
Normal is the plain upstream plugin, installed as-is. You invoke its skills yourself.
Claude Code
The plugin> /plugin marketplace add ghostsecurity/skillsAuto-invocation> /plugin marketplace add flowy-sh/flowy-core> /plugin install flowy-core> /plugin install flowy-ghost
Codex
$ npx skills add ghostsecurity/skills --skill exo proxy repo-context report scan-code scan-deps scan-secrets validate -a codex
Cursor
$ npx skills add ghostsecurity/skills --skill exo proxy repo-context report scan-code scan-deps scan-secrets validate -a cursor
Gemini CLI
$ npx skills add ghostsecurity/skills --skill exo proxy repo-context report scan-code scan-deps scan-secrets validate -a gemini-cli
GitHub Copilot
$ npx skills add ghostsecurity/skills --skill exo proxy repo-context report scan-code scan-deps scan-secrets validate -a github-copilot
OpenCode
$ npx skills add ghostsecurity/skills --skill exo proxy repo-context report scan-code scan-deps scan-secrets validate -a opencode
Windsurf
$ npx skills add ghostsecurity/skills --skill exo proxy repo-context report scan-code scan-deps scan-secrets validate -a windsurf
What's inside
8 Skills
/exoThe single interface for building, improving, and debugging exo workflows. Routes to one of three intents. BUILD takes a rough idea, or an agent template slug from the ghostsecurity.ai catalog, through interrogation, assessment, resource creation in dependency order, and one/proxyStarts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by/repo-contextScans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis./reportGhost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability/scan-codeGhost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for issues like SQL injection, XSS, BOLA, BFLA, SSRF, and other OWASP categories. Supports applications (backend, frontend, mobile) and libraries (prototype/scan-depsGhost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable/scan-secretsGhost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for/validateThis skill should be used when the user asks to "validate a finding", "check if a vulnerability is real", "triage a security finding", "confirm a vulnerability", "determine if a finding is a true positive or false positive", or provides a security finding for review. It
README
Ghost Security Skills
This repository is the Ghost Security plugin marketplace for Claude Code. It ships two plugins: Ghost Security AppSec Skills (ghost) and Ghost Security Exo (exo).
Installation
With Claude Code:
claude plugin marketplace add ghostsecurity/skills
claude plugin install ghost@ghost-security
claude plugin install exo@ghost-security
claude
Alternatively, install the plugins within Claude Code:
/plugin marketplace add ghostsecurity/skills
/plugin install ghost@ghost-security
/plugin install exo@ghost-security
Install only the plugins you need. If the install summary asks for it, run /reload-plugins to activate the plugin.
See Installation and usage for loading the plugins without installing them, where data is stored, and updating.
Ghost Security AppSec Skills
Ghost Security AppSec Skills are an agent-native application security plugin for Claude Code. They give your AI coding agent the tools and skills to find vulnerabilities, prove they're real, and fix them, all inside your existing development workflow.
| Tool | What it does |
|---|---|
| Poltergeist | Secret scanner with dual-engine pattern matching and entropy analysis. |
| Wraith | Dependency scanner powered by the OSV database. |
| Reaper | MITM HTTPS proxy for live vulnerability validation. |
| Exorcist | AI-powered code analysis covering 102 vulnerability types. |
These four tools are composed by an AI skills layer that orchestrates them into a complete security pipeline, from discovery to proof to fix. Get started with the installation and usage guide.
| Skill | Description |
|---|---|
ghost-repo-context | Build shared repository context (business criticality, sensitive data, component map) |
ghost-scan-deps | Exploitability analysis of dependency vulnerabilities (SCA) |
ghost-scan-secrets | Context assessment of detected secrets and credentials |
ghost-scan-code | AI-powered detection of code security issues (SAST) |
ghost-report | Combined security report across all scan results |
ghost-validate | Dynamic validation of findings against a live application (DAST) |
ghost-proxy | HTTP proxy for the ghost-validate skill |
How Ghost Security AppSec Skills work
Ghost Security AppSec Skills are built on a simple idea: real tools produce real data, and AI adds judgment on top.
Poltergeist, Wraith, and Reaper are standalone binaries that each do one job well. Poltergeist scans for secrets. Wraith scans dependencies. Reaper captures live traffic. These are deterministic tools that produce structured, reliable output.
The AI layer comes in through AI skills, orchestration prompts that compose these tools with reasoning. A skill runs Poltergeist, reads the results, examines the surrounding code, and tells you whether each match is a real leaked credential or a benign artifact that can be ignored.
This two-layer architecture means:
- Ground truth comes from tools. Pattern matches, CVE lookups, and traffic captures are deterministic and auditable.
- Judgment comes from AI. Exploitability analysis, context assessment, and prioritization use the same reasoning a security engineer would.
- You get findings, not alerts. Every result includes context about why it matters and what to do about it.
Ghost Security AppSec Skills follow a three-stage loop: find, validate, fix. Scanners find candidates, AI analyzes each candidate for exploitability, and findings include remediation guidance your agent can apply directly. Read more about how the scan lifecycle works.
Open source and composable
Ghost Security AppSec Skills and their underlying tools are fully open source. Everything is available for inspection and contribution.
The tools can also be used standalone. You can use Poltergeist for secret scanning without touching the rest of the skills. The skills compose them into a pipeline, but the pipeline is optional. Use as much or as little as your workflow needs.
- Poltergeist, Wraith, and Reaper are Go binaries distributed via GitHub releases
- Skills are prompt files that run in Claude Code
- Rules and criteria are YAML files you can extend, customize, or replace
- Results stay on your machine and are cached to speed up subsequent runs. Wraith queries the OSV database over the network to look up vulnerabilities.
Ghost Security Exo
The ghost-exo skill builds, improves, and debugs workflows on exo, an agent orchestration platform. It routes each request to one of three intents: build, improve, or debug. See Ghost Security Exo for connecting the exo MCP server and using each intent.
Documentation
Getting started
How it works
Capabilities
Tools
Community
Ghost Security Exo
Contributions, Feedback, Feature Requests, and Issues
Open an Issue per the Contributing guidelines and Code of Conduct
License
This repository is licensed under the Apache License 2.0. See LICENSE for details.
Stars on GitHub
Momentum
- stars in total
- 443
File tree
Similar plugins.
@morlutoreverse-skill
A skill pack for authorized reverse engineering, security research, and penetration testing that routes tasks to the right skill and sets up needed tools on demand. It covers API security assessment and Android APK analysis, among others.
46 skills45k
@zhaoxuya520cybersecurity-skills
Gives an AI agent the step-by-step workflow a senior security analyst follows, covering when to use each technique, what to check first, how to run it and how to verify the result. Covers incident response, forensics, threat intelligence, malware analysis, penetration testing and red teaming.
200 skills36k
@mukul975watermarks-remover
Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files, for privacy and hygiene on content you own. The skill is a thin client: it drives the machinery over HTTP, so the agent host needs no Python.
2 skills1 hook26k
@guillaumemeyerQuestions about skills.
Install it once and the right skill fires as you prompt, with no slash command to remember. It is listed on Flowy in the Security category. It includes exo, proxy, repo-context. Free and open source.
- What is skills?
- ghostsecurity/skills is a Claude Code plugin marketplace from Ghost Security that ships skills and agents for application security. It covers code scanning for issues like SQL injection and XSS, a combined security report, and an HTTP/HTTPS traffic proxy for capturing and replaying requests.
- How do I install skills?
- Run these in Claude Code: /plugin marketplace add ghostsecurity/skills. Then prompt normally.
- Does skills auto-invoke its skills?
- Yes. It ships a FLOW.md router that Flowy's hook fires, so the matching skill runs as you prompt. You never name a skill.
- Is skills free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.
- Which coding agents can use skills's skills?
- skills installs in Claude Code, and its skills also install in Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI. Each skill's page has the install command. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.
Is this plugin yours?
Claim it with GitHubSubmit a pluginPromote it