Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
Ghost Security — combined security report. An agent skill from ghostsecurity/skills.
Install Ghost Report
$ npx skills add ghostsecurity/skills --skill ghost-report -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install ghostsecurity/skills ghost-report --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/ghostsecurity/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ghost/skills/report .claude/skills/ghost-report && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "ghost-report" agent skill from https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/report into .claude/skills/ghost-report/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ghost-report", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/reportType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add ghostsecurity/skills --skill ghost-report -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install ghostsecurity/skills ghost-report --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ghostsecurity/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/ghost/skills/report .agents/skills/ghost-report && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "ghost-report" agent skill from https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/report into .agents/skills/ghost-report/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ghost-report", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ghostsecurity/skills --skill ghost-report -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install ghostsecurity/skills ghost-report --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ghostsecurity/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/ghost/skills/report .cursor/skills/ghost-report && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "ghost-report" agent skill from https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/report into .cursor/skills/ghost-report/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ghost-report", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/ghostsecurity/skills.git --path plugins/ghost/skills/report--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add ghostsecurity/skills --skill ghost-report -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install ghostsecurity/skills ghost-report --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ghostsecurity/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/ghost/skills/report .gemini/skills/ghost-report && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "ghost-report" agent skill from https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/report into .gemini/skills/ghost-report/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ghost-report", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install ghostsecurity/skills ghost-reportInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add ghostsecurity/skills --skill ghost-report -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/ghostsecurity/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/ghost/skills/report .github/skills/ghost-report && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "ghost-report" agent skill from https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/report into .github/skills/ghost-report/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ghost-report", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add ghostsecurity/skills --skill ghost-report -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install ghostsecurity/skills ghost-report --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/ghostsecurity/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/ghost/skills/report .opencode/skills/ghost-report && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "ghost-report" agent skill from https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/report into .opencode/skills/ghost-report/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "ghost-report", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
ghost-report- GitHub stars
- 408
- Token cost
- ~1.4k tokens
- SKILL.md length
- 582 words
- Files
- 2
- Skills in repo
- 5
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Ghost Security — combined security report. An agent skill from ghostsecurity/skills.
- Works in 8 steps: Setup → Read Repo Context → Discover Scan Results → …
- The user requests a security overview
- SKILL.md covers Step 0: Setup, Cache Check, Step 1: Read Repo Context and Step 2: Discover Scan Results, plus 5 more sections
- Calls git
What it does
Ghost Report is an agent skill from ghostsecurity/skills. Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary, full security audit, or combined scan results.
Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. The skill folder holds 1 other file (for example `report-template.md`).
It sits in Security, covering Security review. The repository describes itself as: Ghost Security's collection of AppSec skills for AI coding agents. The licence is Apache-2.0.
When your agent uses it
- The user requests a security overview
- Vulnerability summary
- Full security audit
- Combined scan results
Example prompts
- “/ghost-report”
Requirements
- Pre-approved tools (allowed-tools): Read, Write, Edit, Glob, Grep, Bash
Workflow steps
8 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 25fdf06. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
ReadWriteEditGlobGrepBash
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
git
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Ghost Report loads about 1.4k tokens when it runs. Until then it costs about 85 tokens; SKILL.md has 582 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
allowed-tools: Read, Write, Edit, Glob, Grep, Bash
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from ghostsecurity/skills at commit 25fdf06, republished under its Apache-2.0 licence (© ghostsecurity). 582 words, ~1,415 tokens.
Download SKILL.mdSave it as
.claude/skills/ghost-report/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- ghost-report
- description
- Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary, full security audit, or combined scan results.
- allowed-tools
- Read, Write, Edit, Glob, Grep, Bash
- license
- apache-2.0
- metadata.version
- 1.1.0
Combined Security Report
You aggregate findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report. Do all work yourself — do not spawn subagents or delegate.
$ARGUMENTS
Step 0: Setup
Run this Bash command to compute paths:
repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin | cut -c1-8) && repo_id="${repo_name}-${short_hash}" && short_sha=$(git rev-parse --short HEAD 2>/dev/null || date +%Y%m%d) && ghost_repo_dir="$HOME/.ghost/repos/${repo_id}" && scans_dir="${ghost_repo_dir}/scans/${short_sha}" && cache_dir="${ghost_repo_dir}/cache" && skill_dir=$(find . -path '*/skills/report/SKILL.md' 2>/dev/null | head -1 | xargs dirname) && echo "scans_dir=$scans_dir cache_dir=$cache_dir skill_dir=$skill_dir"Store scans_dir (commit-level scan directory), cache_dir, and skill_dir.
Cache Check
If <scans_dir>/report.md already exists, show:
Combined security report is at: <scans_dir>/report.mdAnd stop. Do not regenerate it.
Step 1: Read Repo Context
Read <cache_dir>/repo.md if it exists. Extract:
- Business criticality
- Sensitive data types
- Component map
If it does not exist, continue without it — this is not an error.
Step 2: Discover Scan Results
List the contents of <scans_dir> to see which scan-type directories exist. Recognized types:
deps/— SCA / dependency vulnerability scansecrets/— secrets and credentials scancode/— code security scan (SAST)
If none of these directories exist, report an error:
No scan results found in <scans_dir>. Run one or more scan skills first:
/ghost-scan-deps
/ghost-scan-secrets
/ghost-scan-codeAnd stop.
Step 3: Collect Findings
For each scan type that exists, glob <scans_dir>/<type>/findings/*.md and read each finding file in full. Retain the complete markdown body of every finding — the report will inline this content directly so readers never need to open individual finding files.
From each finding, also extract these metadata fields for filtering and sorting:
- ID — from
## Metadata→ID - Type — the scan type (
deps,secrets, orcode) - Severity — from
## Metadata→Severity(high, medium, low) - Status — from
## Metadata→Status(e.g., confirmed-exploitable, unverified, verified, rejected, clean)
Step 4: Filter and Sort
Filter: Keep only high-confidence findings:
- For
depsfindings: status isconfirmed-exploitable - For
secretsfindings: status is NOTcleanand NOTrejected - For
codefindings: status isverifiedorunverified(NOTrejected)
Exclude any finding with status clean, rejected, or false-positive.
Sort the remaining findings:
- By severity: high first, then medium, then low
- Within same severity: deps before secrets before code
Step 5: Read Per-Scan Reports
For deps and secrets scan types, read <scans_dir>/<type>/report.md if present. Extract:
- Statistics (candidates scanned, confirmed findings, false positives filtered)
- Executive summary highlights
Note: code does not produce a report.md. For code scan coverage, count the finding files in <scans_dir>/code/findings/ directly. The "Candidates Scanned" count is the total number of finding files (all statuses). "Confirmed Findings" is the count with status verified, confirmed, or unverified. "False Positives Filtered" is the count with status rejected. Do NOT count clean file analyses from the nomination/analysis funnel — those never became findings.
If a per-scan report does not exist for deps or secrets, note it as unavailable.
Show full SKILL.md (189 more words)Show less
Step 6: Generate Report
- Read
<skill_dir>/report-template.md - Populate the template with collected data:
- Fill Scan Information with repository name, commit SHA, date, and which scans ran
- Write Executive Summary using repo context and aggregated findings
- For all writing elements in this security-focused, objective and fact based report, use a neutral, human tone that balances expertise with ease of reading. Do not use emojis, em-dashes, etc.
- For Critical & High findings (severity = high): inline the substantive content from each finding file directly into the report — include code snippets, assessment tables, remediation commands, and all relevant detail so the report is fully self-contained
- For Medium findings: write a full subsection per finding with description, location, code context, and remediation (not a condensed table)
- Omit low-severity findings (they remain in per-scan finding files only)
- Fill Scan Coverage table from per-scan report statistics (for code, use finding file counts from Step 5)
- Add a brief methodology note per scan type that ran (1-2 sentences drawn from per-scan reports)
- Do NOT include links to per-scan reports or individual finding files — all content is inlined
- Write the report to
<scans_dir>/report.md
Step 7: Show Output
Combined security report is at: <scans_dir>/report.md© ghostsecurity, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file in plugins/ghost/skills/report of ghostsecurity/skills.
- SKILL.md
- report-template.md
Open the folder on GitHubat commit 25fdf06
Compare with similar skills
Ghost Report next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Ghost Report this skillghostsecurity/skills | 408 | — | ~1.4k | Automated safety check: Notes | Apache-2.0 | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Kubernetes Network Security Auditkubeshark/kubeshark | 12k | — | ~7.3k | Automated safety check: Notes | Apache-2.0 | |
| Agentlas Security Scanagentlas-ai/Agentlas-OS | 1.6k | 1 repos | ~822 | Automated safety check: Pass | Apache-2.0 | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Semgrep Security Scantrailofbits/skills | 7.4k | — | ~3.7k | Automated safety check: Notes | CC-BY-SA-4.0 |
Similar skills
- Official
Kubernetes Network Security Audit
kubeshark/kubeshark
Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.
Agentlas Security Scan
agentlas-ai/Agentlas-OS
A skill your agent uses when an agent folder must pass the Agentlas Cloud 2-stage security scan (static rules + BYOK LLM judgment) before private sync or public publish, or when asked to…
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
- Official
Semgrep Security Scan
trailofbits/skills
Detects languages, proposes rulesets for approval, then runs the approved Semgrep scan across a codebase and merges the output into one SARIF file.
Skillward Audit
Fangcun-AI/SkillWard
Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.
More from ghostsecurity/skills
Ghost Exo
ghostsecurity/skills
The single interface for building, improving, and debugging exo workflows.
Ghost Repo Context
ghostsecurity/skills
Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file.
Ghost Scan Deps
ghostsecurity/skills
Ghost Security - Software Composition Analysis (SCA) scanner.
Ghost Scan Secrets
ghostsecurity/skills
Ghost Security - Secrets and credentials scanner. An agent skill from ghostsecurity/skills.
Related
Categories
Questions about Ghost Report
What does Ghost Report do?
Ghost Security — combined security report. An agent skill from ghostsecurity/skills. Ghost Report is an agent skill from ghostsecurity/skills. Ghost Security — combined security report.
When should I use Ghost Report?
Ghost Report fits situations like: the user requests a security overview; vulnerability summary; full security audit; combined scan results.
How do I install Ghost Report in Claude Code?
Run `npx skills add ghostsecurity/skills --skill ghost-report -a claude-code`. Or copy the skill folder (plugins/ghost/skills/report in ghostsecurity/skills) into .claude/skills/ghost-report in your project. Claude Code loads it when a task matches its description.
How do I install Ghost Report in Codex?
Run `npx skills add ghostsecurity/skills --skill ghost-report -a codex`. Or copy the skill folder (plugins/ghost/skills/report in ghostsecurity/skills) into .agents/skills/ghost-report in your project. Codex loads it when a task matches its description.
Can I use Ghost Report in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ghostsecurity/skills --skill ghost-report -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/ghost-report, .gemini/skills/ghost-report, .github/skills/ghost-report and .opencode/skills/ghost-report in your project.
What does Ghost Report need to run?
Going by SKILL.md and its folder, Ghost Report needs the command-line tools its instructions call (git). Its frontmatter pre-approves these tools: Read, Write, Edit, Glob, Grep, Bash.
Does Ghost Report access the network?
SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Ghost Report safe to install?
Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Ghost Report use?
Ghost Report is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Ghost Report use?
About 1.4k tokens (SKILL.md is roughly 5.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Ghost Report?
Skills that share tags, products or a category with Ghost Report: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Agentlas Security Scan (agentlas-ai/Agentlas-OS, 1.6k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Ghost Report?
ghostsecurity (a GitHub organization) maintains it in ghostsecurity/skills, which has 408 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on September 28, 2026.
Source: ghostsecurity/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.