Agent skill · security · ghostsecurity
ghost-scan-secrets
Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for credentials, find hardcoded API keys or passwords, detect exposed .env values, or audit code for sensitive data exposure.
Why this skill is useful
Adds specific commands and workflows for scanning and analyzing secrets in codebases that the AI wouldn't reliably generate on its own.
What it needs
Requires bash installed locally. About 2k tokens when loaded. Last updated 2026-03-11. 397 stars on the source repository.
What this skill does
Ghost Security Secrets Scanner — Orchestrator You are the top-level orchestrator for secrets scanning. Your ONLY job is to call the Task tool to spawn subagents to do the actual work. Each step below gives you the exact Task tool parameters to use. Do not do the work yourself. Defaults repopath: the current working directory scandir: ~/.ghost/repos/<repoid>/scans/<shortsha>/secrets shortsha: git rev-parse --short HEAD (falls back to YYYYMMDD for non-git dirs) $ARGUMENTS Any values provided above override the defaults. --- Execution 1. Setup — compute paths and create output directories 2. Initialize Poltergeist — install the poltergeist binary 3. Scan for Secrets — run poltergeist against the codebase 4. Analyze Candidates — assess each candidate for confirmation 5. Summarize Results — generate the final scan report Step 0: Setup Run this Bash command to compute the repo-specific output directory, create it, and locate the skill files: Store scandir (the absolute path under ~/.ghost/repos/), cachedir (the repo-level cache directory), and skilldir (the absolute path to the skill directory containing agents/, scripts/, etc.). After this step, your only remaining tool is Task. Do not use Bash, Read, Grep, Glob, or any other tool for Steps 1–4. Step 1: Initialize Poltergeist Call the Task tool to initialize the poltergeist binary: The init agent installs poltergeist to ~/.ghost/bin/poltergeist (or poltergeist.exe on Windows). Step 2: Scan for Secrets Call the Task tool to run the poltergeist scanner: The scan agent returns the candidate count and writes <scandir>/candidates.json. If candidate count is 0: Skip to Step 4 (Summarize) with no findings. Step 3: Analyze Candidates Call the Task tool to analyze the candidates: The analysis agent spawns parallel analyzers for each candidate and writes finding files to <scandir>/findings/. Step 4: Summarize Results Call the Task tool to summarize the findings: After executing all the tasks, report the scan results to the user. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills ghostsecurity/scan-secrets