Security
Plugin
ghostsecurity-skills
Plugin marketplace repository for Ghost Security's AI-native application security skills for Claude Code.
Plugin Signal56/100Fair
maintained34
capable52
documented100
adopted55
Install on Claude Code
> /plugin marketplace add ghostsecurity/skills> /plugin install ghost@ghost-security
What's inside
Skills
7/proxyStarts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by/repo-contextScans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis./reportGhost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability/scan-codeGhost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for issues like SQL injection, XSS, BOLA, BFLA, SSRF, and other OWASP categories. Supports applications (backend, frontend, mobile) and libraries (prototype/scan-depsGhost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable/scan-secretsGhost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for
Agents
4agentYou are the analysis orchestrator. Your job is to dispatch analyzer agents for each vulnerability candidate found by the scanner.analyzerYou are an exploitability analysis agent. Your job is to determine whether a detected vulnerability is actually exploitable in the target codebase. Most CVEs are theoretical risks that don't apply due to how the code is written. If a vulnerability is genuinely exploitable, youtemplate-finding- **ID**: <finding_id> - **Type**: sca-vulnerability - **Package**: <package_name>@<version> - **Ecosystem**: <ecosystem> - **Vulnerability ID**: <vuln_id> - **CVEs**: <cve_list> - **Severity**: <high|medium|low> - **Status**: confirmed-exploitabletemplate-report- **Repository**: <repo_path> - **Scan ID**: <scan_id> - **Date**: <timestamp> - **Scanner**: Wraith (OSV-Scanner) + Ghost AI Exploitability Analysis
README
1Ghost Security Skills/Plugin Marketplace
Plugin marketplace repository for Ghost Security's AI-native application security skills for Claude Code.
Quick Installation
With Claude Code:
claude plugin marketplace add ghostsecurity/skills
claude plugin install ghost@ghost-security
claude
Alternatively, install the skills plugin within Claude Code:
/plugin marketplace add ghostsecurity/skills
/plugin install ghost@ghost-security
Currently, you will need to restart Claude Code for the plugin to load.
Comprehensive Documentation
Full documentation, tutorials, and video guides at ghostsecurity.ai.
Skills in this Repository Marketplace
| Skill | Description |
|---|---|
ghost-repo-context | Build shared repository context (business criticality, sensitive data, component map) |
ghost-scan-deps | Exploitability analysis of dependency vulnerabilities (SCA) |
ghost-scan-secrets | Context assessment of detected secrets and credentials |
ghost-scan-code | AI-powered detection of code security issues (SAST) |
ghost-report | Combined security report across all scan results |
ghost-validate | Dynamic validation of findings against a live application (DAST) |
ghost-proxy | HTTP proxy for the ghost-validate skill |
ghost-repo-context
ghost-scan-code
ghost-scan-deps
ghost-scan-secrets
ghost-validate
ghost-report
Contributions, Feedback, Feature Requests, and Issues
Open an Issue per the Contributing guidelines and Code of Conduct
License
This repository is licensed under the Apache License 2.0. See LICENSE for details.
File tree
51ghostsecurity/skillsView on GitHub
.claude-plugin/
marketplace.json
.github/
CODE_OF_CONDUCT.md
CONTRIBUTING.md
ISSUE_TEMPLATE/
Bug-Report.yml
Question.yml
.gitignore
LICENSE
plugins/
ghost/
.claude-plugin/
plugin.json
CHANGELOG.md
README.md
skills/
proxy/
SKILL.md
repo-context/
detector.md
SKILL.md
summarizer.md
template-repo.md
report/
report-template.md
SKILL.md
scan-code/
criteria/
backend.yaml
frontend.yaml
index.yaml
library.yaml
mobile.yaml
prompts/
analyzer.md
nominator.md
planner.md
template-finding.md
verifier.md
scripts/
loop.sh
SKILL.md
scan-deps/
agents/
analyze/
agent.md
analyzer.md
template-finding.md
discover/
agent.md
init/
agent.md
scan/
agent.md
summarize/
agent.md
template-report.md
README.md
SKILL.md
scan-secrets/
agents/
analyze/
agent.md
analyzer.md
template-finding.md
init/
agent.md
scan/
agent.md
summarize/
agent.md
template-report.md
README.md
SKILL.md
validate/
SKILL.md
VULNERABILITY_PATTERNS.md
README.mdFAQ
ghostsecurity-skills is a Claude Code plugin with 7 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes proxy, repo-context, report. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
- What is ghostsecurity-skills?
- Plugin marketplace repository for Ghost Security's AI-native application security skills for Claude Code.
- How do I install ghostsecurity-skills?
- Run these in Claude Code: /plugin marketplace add ghostsecurity/skills then /plugin install ghost@ghost-security. Then prompt normally.
- Does ghostsecurity-skills auto-invoke its skills?
- Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.
- Is ghostsecurity-skills free?
- Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.