Ghost Scan Deps

It installs a binary called wraith, discovers lockfiles across multiple ecosystems (package-lock.json, go.mod, Gemfile.lock), scans them for CVEs, then analyzes each finding for exploitability before generating a report. Everything gets stored under ~/.ghost/repos with per-commit scan directories. The multi-agent workflow is interesting but adds layers between you and the actual scanner. If you need a quick dependency audit and don't mind the orchestration overhead, it covers the major package managers. The exploitability analysis step could be genuinely useful for triaging noisy CVE lists.