Ghost Scan Deps

What it does

When your agent uses it

• The user asks about dependency vulnerabilities
• Vulnerable packages
• Security audits of dependencies
• Wants to scan lockfiles like package-lock.json

Example prompts

• “/ghost-scan-deps”

Requirements

• Pre-approved tools (allowed-tools): Read, Glob, Grep, Bash, Task, TodoRead, TodoWrite

Workflow steps

6 steps, taken from the step headings in SKILL.md.

1. 1Setup
2. 2Initialize Wraith
3. 3Discover Lockfiles
4. 4Scan for Vulnerabilities
5. 5Analyze Candidates
6. 6Summarize Results

What it can do on your machine

Read from SKILL.md and the folder at commit 25fdf06. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Glob
  • Grep
  • Bash
  • Task
  • TodoRead
  • TodoWrite

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • git

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Ghost Scan Deps loads about 1.3k tokens when it runs. Until then it costs about 107 tokens; SKILL.md has 375 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~107

When it runs · the whole SKILL.md, loaded when a task matches

~1.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Read, Glob, Grep, Bash, Task, TodoRead, TodoWrite

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ghostsecurity/skills at commit 25fdf06, republished under its Apache-2.0 licence (© ghostsecurity). 375 words, ~1,339 tokens.

name

ghost-scan-deps

description

Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.mod, or Gemfile.lock.

allowed-tools

Read, Glob, Grep, Bash, Task, TodoRead, TodoWrite

argument-hint

[path-to-scan]

license

apache-2.0

metadata.version

1.1.0

repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin | cut -c1-8) && repo_id="${repo_name}-${short_hash}" && short_sha=$(git rev-parse --short HEAD 2>/dev/null || date +%Y%m%d) && ghost_repo_dir="$HOME/.ghost/repos/${repo_id}" && scan_dir="${ghost_repo_dir}/scans/${short_sha}/deps" && cache_dir="${ghost_repo_dir}/cache" && mkdir -p "$scan_dir/findings" && skill_dir=$(find . -path '*skills/scan-deps/SKILL.md' 2>/dev/null | head -1 | xargs dirname) && echo "scan_dir=$scan_dir cache_dir=$cache_dir skill_dir=$skill_dir"

{
  "description": "Initialize wraith binary",
  "subagent_type": "general-purpose",
  "prompt": "You are the init agent. Read and follow the instructions in <skill_dir>/agents/init/agent.md.\n\n## Inputs\n- skill_dir: <skill_dir>"
}

{
  "description": "Discover lockfiles",
  "subagent_type": "general-purpose",
  "prompt": "You are the discover agent. Read and follow the instructions in <skill_dir>/agents/discover/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>"
}

{
  "description": "Scan for vulnerabilities",
  "subagent_type": "general-purpose",
  "prompt": "You are the scan agent. Read and follow the instructions in <skill_dir>/agents/scan/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>"
}

{
  "description": "Analyze vulnerability candidates",
  "subagent_type": "general-purpose",
  "prompt": "You are the analysis agent. Read and follow the instructions in <skill_dir>/agents/analyze/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>\n- skill_dir: <skill_dir>\n- cache_dir: <cache_dir>"
}

{
  "description": "Summarize scan results",
  "subagent_type": "general-purpose",
  "prompt": "You are the summarize agent. Read and follow the instructions in <skill_dir>/agents/summarize/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>\n- skill_dir: <skill_dir>\n- cache_dir: <cache_dir>"
}

© ghostsecurity, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 9 other files in plugins/ghost/skills/scan-deps of ghostsecurity/skills.

• SKILL.md
• README.md
• agents/analyze/agent.md
• agents/analyze/analyzer.md
• agents/analyze/template-finding.md
• agents/discover/agent.md
• agents/init/agent.md
• agents/scan/agent.md
• agents/summarize/agent.md
• agents/summarize/template-report.md

Open the folder on GitHubat commit 25fdf06