exo
The single interface for building, improving, and debugging exo workflows. Routes to one of three intents. BUILD takes a rough…
Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis.
Claude Code
$ npx -y skills add ghostsecurity/skills --skill repo-context --agent claude-code
Codex
$ npx skills add ghostsecurity/skills --skill repo-context -a codex -y
Cursor
$ npx skills add ghostsecurity/skills --skill repo-context -a cursor -y
Gemini CLI
$ npx skills add ghostsecurity/skills --skill repo-context -a gemini-cli -y
GitHub Copilot
$ npx skills add ghostsecurity/skills --skill repo-context -a github-copilot -y
OpenCode
$ npx skills add ghostsecurity/skills --skill repo-context -a opencode -y
Windsurf
$ npx skills add ghostsecurity/skills --skill repo-context -a windsurf -y
name: "ghost-repo-context" description: "Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis." allowed-tools: Read, Write, Edit, Glob, Grep, Bash license: apache-2.0 metadata: version: 1.1.0
You gather repository context by detecting projects, summarizing their architecture, and writing the results to `repo.md`. Do all work yourself — do not spawn subagents or delegate.
Parse these from `$ARGUMENTS` (key=value pairs):
$ARGUMENTS
If `cache_dir` is not provided, compute it:
repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin | cut -c1-8) && repo_id="${repo_name}-${short_hash}" && cache_dir="$HOME/.ghost/repos/${repo_id}/cache" && echo "cache_dir=$cache_dir"Do NOT use WebFetch or WebSearch. All work must use only local files in the repository.
Discover this skill's own directory so you can reference agent files:
skill_dir=$(find . -path '*/skills/repo-context/SKILL.md' 2>/dev/null | head -1 | xargs dirname) echo "skill_dir=$skill_dir"
---
Check if `<cache_dir>/repo.md` already exists. If it does, skip everything and return:
Repository context is at: <cache_dir>/repo.md
If it does not exist, run `mkdir -p <cache_dir>` and continue.
---
1. **Detect Projects** — Read `<skill_dir>/detector.md` and follow its instructions against `<repo_path>`. Save the full detection output (project details needed for step 2). If detection finds no projects, write a minimal `repo.md` noting "No projects detected" and skip to step 4.
2. **Summarize Each Project** — Read `<skill_dir>/summarizer.md`. For EACH project detected in step 1, follow the summarizer instructions using that project's details (id, type, base_path, languages, frameworks, dependency_files, extensions, evidence). Collect the summary for each project. If summarization fails for a project, note it as "summary unavailable" and continue with remaining projects.
3. **Write repo.md** — Combine detection and summary results into `<cache_dir>/repo.md` using the format in `<skill_dir>/template-repo.md`. For each project include:
4. **Validate** — Read `<cache_dir>/repo.md` back and verify it contains the expected sections from `<skill_dir>/template-repo.md` (e.g., project entries with Detection and Summary fields). If the file is missing or malformed, retry the write once before reporting an error.
5. **Output** — Return: `Repository context is at: <cache_dir>/repo.md`
This repository is the Ghost Security plugin marketplace for Claude Code. It ships two plugins: Ghost Security AppSec Skills (ghost) and Ghost Security Exo (exo).
The single interface for building, improving, and debugging exo workflows. Routes to one of three intents. BUILD takes a rough…
Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers.…
Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a…
Ghost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for…
Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies…
Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data.…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…