Ghost Scan Deps

This is an orchestrator skill that runs Software Composition Analysis on your codebase by spawning a chain of subagents to hunt for dependency vulnerabilities. It installs a binary called wraith, discovers lockfiles across multiple ecosystems (package-lock.json, go.mod, Gemfile.lock), scans them for CVEs, then analyzes each finding for exploitability before generating a report. Everything gets stored under ~/.ghost/repos with per-commit scan directories. The multi-agent workflow is interesting but adds layers between you and the actual scanner. If you need a quick dependency audit and don't mind the orchestration overhead, it covers the major package managers. The exploitability analysis step could be genuinely useful for triaging noisy CVE lists.

Install to Claude Code

npx -y skills add ghostsecurity/skills --skill ghost-scan-deps --agent claude-code