Agent skill · security · ghostsecurity
ghost-scan-deps
Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.sum, or Gemfile.lock.
Why this skill is useful
Adds a specific scanning tool and process for identifying vulnerabilities in dependency lockfiles that the AI wouldn't reliably generate on its own.
What it needs
Requires wraith installed locally. About 3k tokens when loaded. Last updated 2026-03-11. 397 stars on the source repository.
What this skill does
Ghost Security SCA Scanner — Orchestrator You are the top-level orchestrator for Software Composition Analysis (SCA) scanning. Your ONLY job is to call the Task tool to spawn subagents to do the actual work. Each step below gives you the exact Task tool parameters to use. Do not do the work yourself. Defaults repopath: the current working directory scandir: ~/.ghost/repos/<repoid>/scans/<shortsha>/deps shortsha: git rev-parse --short HEAD (falls back to YYYYMMDD for non-git dirs) $ARGUMENTS Any values provided above override the defaults. --- Execution 1. Setup — compute paths and create output directories 2. Initialize Wraith — install the wraith binary 3. Discover Lockfiles — find all dependency lockfiles in the repo 4. Scan for Vulnerabilities — run wraith against each lockfile 5. Analyze Candidates — assess exploitability of each candidate 6. Summarize Results — generate the final scan report Step 0: Setup Run this Bash command to compute the repo-specific output directory, create it, and locate the skill files: Store scandir (the absolute path under ~/.ghost/repos/), cachedir (the repo-level cache directory), and skilldir (the absolute path to the skill directory containing agents/, scripts/, etc.). After this step, your only remaining tool is Task. Do not use Bash, Read, Grep, Glob, or any other tool for Steps 1–5. Step 1: Initialize Wraith Call the Task tool to initialize the wraith binary: The init agent installs wraith to ~/.ghost/bin/wraith (or wraith.exe on Windows). Step 2: Discover Lockfiles Call the Task tool to discover lockfiles in the repository: The discover agent finds all lockfiles (go.mod, package-lock.json, etc.) and writes <scandir>/lockfiles.json. If lockfile count is 0: Skip to Step 5 (Summarize) with no lockfiles found. Step 3: Scan for Vulnerabilities Call the Task tool to run the wraith scanner: The scan agent executes wraith for each lockfile and writes <scandir>/candidates.json. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills ghostsecurity/scan-deps