ghost-report
Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary, full security audit, or combined scan results.
Security Assessment
About ghost-report
The ghost-report skill is a comprehensive security aggregation tool that combines findings from multiple security scanning skills (scan-deps, scan-secrets, and scan-code) into a single, prioritized report. It solves the problem of security fragmentation by providing a unified view of all vulnerabilities across dependency scanning (SCA), secrets detection, and static code analysis (SAST). Instead of reviewing multiple separate reports, security teams and developers can access one consolidated document that highlights the highest-risk, highest-confidence issues.
The skill automatically filters findings based on confidence levels, retaining only high-quality results: confirmed-exploitable vulnerabilities for dependencies, non-rejected secrets, and verified or unverified code issues. It sorts findings by severity (high, medium, low) and type priority (dependencies first, then secrets, then code), ensuring critical issues surface immediately. The report includes full markdown content from each finding inline, eliminating the need to navigate between multiple files. It also integrates repository context when available, incorporating business criticality and sensitive data types to provide risk-aware analysis.
This skill is designed for security engineers, DevSecOps teams, and development leads who need to perform security audits, generate compliance reports, or quickly assess the overall security posture of a codebase. It's particularly valuable during release cycles, security reviews, or when onboarding new projects. The skill operates autonomously without spawning subagents, uses intelligent caching to avoid redundant work, and requires no manual configuration beyond running the prerequisite scan skills.
FAQ
What scan skills must I run before using ghost-report?
You need to run at least one of the three scanning skills: /ghost-scan-deps (dependency vulnerabilities), /ghost-scan-secrets (credentials and secrets), or /ghost-scan-code (static code analysis). The report will aggregate findings from whichever scans have been executed.
How does the skill filter findings to avoid false positives?
The skill applies confidence-based filtering: for dependencies, only confirmed-exploitable vulnerabilities are included; for secrets, clean and rejected findings are excluded; for code issues, only verified and unverified findings are kept. Any finding marked as rejected, clean, or false-positive is automatically filtered out.
Does the report get regenerated every time I run the skill?
No. The skill uses intelligent caching based on the git commit SHA. If a report already exists for the current commit, it will display the cached version instead of regenerating. To create a new report, make a new commit or manually delete the cached report file.
What file formats and tools does this skill use?
The skill reads and writes markdown files (.md), uses bash commands for path computation and git operations, and employs file system tools (Read, Write, Edit, Glob, Grep) to collect and aggregate scan results. All findings are stored as markdown in a structured directory hierarchy under ~/.ghost/repos.
Can I customize the priority or filtering rules for findings?
The current version uses a fixed filtering and sorting algorithm (severity-first, then type-priority). Customization would require modifying the SKILL.md instructions. The skill prioritizes high-severity findings and orders by type: dependencies, secrets, then code issues within each severity level.
Install ghost-report
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
ghostsecurity/skills