Ghost Security Skills: An Open-Source AppSec Pipeline for Claude Code

Most AI security skills are prompts and nothing else, which leaves the model guessing. Ghost Security Skills takes a different approach: it pairs real scanners that produce deterministic output with AI skills that judge the results. It’s an open-source plugin marketplace for Claude Code, covering secrets, dependencies, code analysis and live validation, and it’s built around one loop: find, validate, fix.

The code is at ghostsecurity/skills, released under Apache 2.0. I’ve read the README and docs rather than running it on a range of projects, so this is an overview rather than a hands-on review.

Two layers: tools and skills

The project’s core idea is that real tools produce real data and AI adds judgment on top. The repo ships four tools:

• Poltergeist: a secret scanner using pattern matching plus entropy analysis, with 163 built-in rules.
• Wraith: a dependency scanner that looks up known vulnerabilities in the OSV database.
• Reaper: a man-in-the-middle HTTPS proxy that captures live traffic so findings can be tested against a running app.
• Exorcist: AI-powered code analysis covering 102 vulnerability types.

Poltergeist, Wraith and Reaper are standalone Go binaries distributed through GitHub releases, so you can use any of them without the rest. The skills are the orchestration layer: prompt files that run a tool, read the output, examine the surrounding code and tell you whether a match is a real leaked credential or a harmless artefact.

The skills

• ghost-repo-context: builds shared context about your repo, including business criticality, sensitive data types and a component map.
• ghost-scan-deps: dependency scanning with exploitability analysis. It asks whether the vulnerable function is actually called and whether user input can reach it.
• ghost-scan-secrets: assesses detected secrets in context.
• ghost-scan-code: AI-powered SAST-style detection.
• ghost-report: a combined, prioritised report across every scan.
• ghost-validate and ghost-proxy: dynamic validation of findings against a live application, using the Reaper proxy.

There’s also a separate plugin, exo, for building, improving and debugging workflows on Ghost Security’s agent orchestration platform. It’s unrelated to the scanning pipeline, so install it only if you use that platform.

How to install it

You need Claude Code. Then:

claude plugin marketplace add ghostsecurity/skills
claude plugin install ghost@ghost-security

You can run the same commands from inside Claude Code with a /plugin prefix, and run /reload-plugins if it asks. To try it without installing, clone the repo and start Claude Code with claude --plugin-dir ~/.ghost/skills/plugins/ghost. Update later with claude plugin update ghost@ghost-security.

How to run a scan

Start claude in your repository and run the skills in this order:

/ghost-repo-context   # build shared repository context first
/ghost-scan-deps      # dependency vulnerabilities (SCA)
/ghost-scan-secrets   # leaked secrets and credentials
/ghost-scan-code      # code security issues (SAST)
/ghost-report         # combined report
/ghost-validate       # optional: test findings against a live app

The skills install the latest tool binaries automatically when they run, so there’s nothing else to set up. Results are stored locally per repository and commit, and the repository context and combined report are reused on later runs.

Privacy and data

The docs say all scan data stays on your machine under ~/.ghost/: binaries in bin/, cached context and results in repos/, and the Reaper database in reaper/. Wraith queries the OSV database over the network to look up vulnerabilities. As with any Claude Code skill, the code Claude reads during the AI analysis goes to Anthropic, so check your own policy before scanning private or client code.

Things to know

• Only validate against apps you own. ghost-validate and the Reaper proxy send live traffic, so point them at your own dev or staging environment, never at someone else’s system.
• It downloads and runs binaries. The skills fetch tool binaries from GitHub releases automatically. That’s convenient, but it’s worth knowing before you run it on a locked-down machine.
• It’s Claude Code only. There’s no Codex or other-agent version in this repo.
• Treat AI findings as leads. The tools are deterministic, but the exploitability and SAST judgments are model output and can be wrong.
• Review before installing. A plugin is instructions and code your agent will run, so skim a third-party one first.

Where it fits

Ghost Security Skills is the most pipeline-like of the Claude security skills I’ve covered. The OWASP skill is lighter: it sharpens Claude’s own review with current standards and runs no tools. The setup in Claude Code found 23 vulnerabilities in my own code uses parallel agents, and the Codex Security CLI is aimed at CI. Ghost is the one to try if you want real secret and dependency scanners behind the AI’s opinions.