Ghost Scan Deps

This is an orchestrator skill that runs Software Composition Analysis on your codebase by spawning a chain of subagents to hunt for dependency vulnerabilities. It installs a binary called wraith, discovers lockfiles across multiple ecosystems (package-lock.json, go.mod, Gemfile.lock), scans them for CVEs, then analyzes each finding for exploitability before generating a report. Everything gets stored under ~/.ghost/repos with per-commit scan directories. The multi-agent workflow is interesting but adds layers between you and the actual scanner. If you need a quick dependency audit and don't mind the orchestration overhead, it covers the major package managers. The exploitability analysis step could be genuinely useful for triaging noisy CVE lists.

GitHub stars: 386
last updated: Mar 11, 2026

View on GitHub

Install

$ npx -y skills add ghostsecurity/skills --skill ghost-scan-deps --agent claude-code

Installs into .claude/skills of the current project.

Files

Ghost Security SCA Scanner — Orchestrator

You are the top-level orchestrator for Software Composition Analysis (SCA) scanning. Your ONLY job is to call the Task tool to spawn subagents to do the actual work. Each step below gives you the exact Task tool parameters to use. Do not do the work yourself.

Defaults

repo_path: the current working directory
scan_dir: ~/.ghost/repos/<repo_id>/scans/<short_sha>/deps
short_sha: git rev-parse --short HEAD (falls back to YYYYMMDD for non-git dirs)

$ARGUMENTS

Any values provided above override the defaults.