ghost-scan-code

90 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By ghostsecurity/skills (GitHub) · security · 443 stars · scanned at commit 25fdf06

Ghost Security - SAST code scanner. Finds security vulnerabilities in source code by planning and executing targeted scans for issues like SQL injection, XSS, BOLA, BFLA, SSRF, and other OWASP categories. Supports applications (backend, frontend, mobile) and libraries (prototype pollution, unsafe deserialization, ReDoS, path traversal, zip slip). Use when the user asks for a code security audit, SAST scan, vulnerability scan of source code, or wants to find security flaws in a codebase or libra…

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 8 places.

plugins/ghost/skills/scan-code/SKILL.md, line 34repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin
plugins/ghost/skills/scan-code/SKILL.md, line 51bash <path-to-loop.sh> $scan_dir planner.md "- depth: <depth>
plugins/ghost/skills/scan-code/SKILL.md, line 80bash <path-to-loop.sh> $scan_dir nominator.md "- depth: <depth>

Show 5 more

plugins/ghost/skills/scan-code/SKILL.md, line 100mkdir -p $scan_dir/findings
plugins/ghost/skills/scan-code/SKILL.md, line 108bash <path-to-loop.sh> $scan_dir analyzer.md "" 5 $cache_dir
plugins/ghost/skills/scan-code/SKILL.md, line 124bash <path-to-loop.sh> $scan_dir verifier.md "" 5 $cache_dir
plugins/ghost/skills/scan-code/criteria/backend.yaml, line 7candidates: "Files with: exec/system/spawn calls (os.exec, subprocess, child_process, Runtime.exec), shell command construction, fmt.Sprintf/string concatenatio
plugins/ghost/skills/scan-code/criteria/library.yaml, line 11candidates: "Files with: exec/spawn/system calls (child_process.exec, execSync, spawn, subprocess.run, subprocess.call, os.system, os.popen, exec.Command), shel

Connects to the internet

The author does not mention this. Expected for a security skill.

Found in 3 places.

plugins/ghost/skills/scan-code/criteria/backend.yaml, line 280candidates: "TLS/HTTPS client configuration (http.Client, requests, axios, fetch with custom TLS), certificate verification settings (InsecureSkipVerify, verify
plugins/ghost/skills/scan-code/criteria/backend.yaml, line 351candidates: "HTTP client calls (http.Get, requests.get, fetch, axios), URL construction with user input, webhook/callback URL handling, image/file fetching from
plugins/ghost/skills/scan-code/criteria/library.yaml, line 166candidates: "Files with: outbound HTTP calls (fetch, axios, got, node-fetch, http.Get, requests.get, urllib.request) using caller-supplied URLs, URL constructio

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'ghost-scan-code' ] || [ -L ~/.agents/skills/'ghost-scan-code' ]; then echo 'A skill folder named ghost-scan-code already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ghostsecurity/skills' "$d" && git -C "$d" checkout --quiet '25fdf068760723b85b40e0224a3b8533e4aab31f' -- 'plugins/ghost/skills/scan-code' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/ghost/skills/scan-code' ~/.agents/skills/'ghost-scan-code' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ghost-scan-code' ~/.claude/skills/'ghost-scan-code' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for ghostsecurity/skills shows the score of its lowest-scoring skill.

SkillTrust badge for ghostsecurity/skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/ghostsecurity/skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/ghostsecurity/skills/)

Score history

Date	Version	Score
2026-11-07	`25fdf06`	90