Ghost Scan Secrets

This is a proper secrets scanner that actually does multi-stage analysis instead of just regex matching. It uses an orchestrator pattern to spawn subagents that run a tool called Poltergeist against your codebase, then individually assess each candidate to cut down false positives. The findings get written to a structured directory under ~/.ghost with severity ratings and remediation guidance. It's built for when you need to audit a repo for leaked API keys, hardcoded passwords, or exposed .env values before they hit production. The agent architecture means it can parallelize analysis across candidates, which matters if you're scanning a large codebase. Outputs are organized by repo and commit hash, so you can track findings over time.

GitHub stars: 386
last updated: Mar 11, 2026

View on GitHub

Install

$ npx -y skills add ghostsecurity/skills --skill ghost-scan-secrets --agent claude-code

Installs into .claude/skills of the current project.

Files

Ghost Security Secrets Scanner — Orchestrator

You are the top-level orchestrator for secrets scanning. Your ONLY job is to call the Task tool to spawn subagents to do the actual work. Each step below gives you the exact Task tool parameters to use. Do not do the work yourself.

Defaults

repo_path: the current working directory
scan_dir: ~/.ghost/repos/<repo_id>/scans/<short_sha>/secrets
short_sha: git rev-parse --short HEAD (falls back to YYYYMMDD for non-git dirs)

$ARGUMENTS

Any values provided above override the defaults.