Ghost Scan Secrets

What it does

When your agent uses it

• The user asks to check for leaked secrets
• Scan for credentials
• Find hardcoded API keys
• Detect exposed .env values

Example prompts

• “/ghost-scan-secrets”

Requirements

• Pre-approved tools (allowed-tools): Read, Glob, Grep, Bash, Task, TodoRead, TodoWrite

Workflow steps

5 steps, taken from the step headings in SKILL.md.

1. 1Setup
2. 2Initialize Poltergeist
3. 3Scan for Secrets
4. 4Analyze Candidates
5. 5Summarize Results

What it can do on your machine

Read from SKILL.md and the folder at commit 25fdf06. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Glob
  • Grep
  • Bash
  • Task
  • TodoRead
  • TodoWrite

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • git

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Ghost Scan Secrets loads about 1.2k tokens when it runs. Until then it costs about 104 tokens; SKILL.md has 316 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~104

When it runs · the whole SKILL.md, loaded when a task matches

~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:4

  ed API keys or passwords, detect exposed .env values, or audit code for sensitive data exposure.

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Read, Glob, Grep, Bash, Task, TodoRead, TodoWrite

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from ghostsecurity/skills at commit 25fdf06, republished under its Apache-2.0 licence (© ghostsecurity). 316 words, ~1,167 tokens.

name

ghost-scan-secrets

description

Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for credentials, find hardcoded API keys or passwords, detect exposed .env values, or audit code for sensitive data exposure.

allowed-tools

Read, Glob, Grep, Bash, Task, TodoRead, TodoWrite

argument-hint

[path-to-scan]

license

apache-2.0

metadata.version

1.1.0

repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin | cut -c1-8) && repo_id="${repo_name}-${short_hash}" && short_sha=$(git rev-parse --short HEAD 2>/dev/null || date +%Y%m%d) && ghost_repo_dir="$HOME/.ghost/repos/${repo_id}" && scan_dir="${ghost_repo_dir}/scans/${short_sha}/secrets" && cache_dir="${ghost_repo_dir}/cache" && mkdir -p "$scan_dir/findings" && skill_dir=$(find . -path '*skills/scan-secrets/SKILL.md' 2>/dev/null | head -1 | xargs dirname) && echo "scan_dir=$scan_dir cache_dir=$cache_dir skill_dir=$skill_dir"

{
  "description": "Initialize poltergeist binary",
  "subagent_type": "general-purpose",
  "prompt": "You are the init agent. Read and follow the instructions in <skill_dir>/agents/init/agent.md.\n\n## Inputs\n- skill_dir: <skill_dir>"
}

{
  "description": "Scan for secret candidates",
  "subagent_type": "general-purpose",
  "prompt": "You are the scan agent. Read and follow the instructions in <skill_dir>/agents/scan/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>"
}

{
  "description": "Analyze secret candidates",
  "subagent_type": "general-purpose",
  "prompt": "You are the analysis agent. Read and follow the instructions in <skill_dir>/agents/analyze/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>\n- skill_dir: <skill_dir>\n- cache_dir: <cache_dir>"
}

{
  "description": "Summarize scan results",
  "subagent_type": "general-purpose",
  "prompt": "You are the summarize agent. Read and follow the instructions in <skill_dir>/agents/summarize/agent.md.\n\n## Inputs\n- repo_path: <repo_path>\n- scan_dir: <scan_dir>\n- skill_dir: <skill_dir>\n- cache_dir: <cache_dir>"
}

© ghostsecurity, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 8 other files in plugins/ghost/skills/scan-secrets of ghostsecurity/skills.

• SKILL.md
• README.md
• agents/analyze/agent.md
• agents/analyze/analyzer.md
• agents/analyze/template-finding.md
• agents/init/agent.md
• agents/scan/agent.md
• agents/summarize/agent.md
• agents/summarize/template-report.md

Open the folder on GitHubat commit 25fdf06