ghost-scan-deps
Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.sum, or Gemfile.lock.
Security Assessment
Detected risks:
About ghost-scan-deps
The `ghost-scan-deps` skill is a Software Composition Analysis (SCA) tool designed to identify vulnerabilities in project dependencies by scanning lockfiles. It automates the process of detecting known security issues, assigning severity levels, and providing remediation guidance, helping developers and security teams mitigate risks in their software supply chain. By analyzing lockfiles such as `package-lock.json`, `yarn.lock`, `go.sum`, and `Gemfile.lock`, the skill ensures that applications are not using vulnerable or outdated packages that could compromise security. It serves as an orchestrator, delegating tasks to specialized subagents for scanning, analysis, and reporting.
FAQ
How do I run a dependency scan using ghost-scan-deps?
Provide the path to the repository or directory you want to scan as an argument. The skill will compute output paths, discover lockfiles, run the vulnerability scanner, analyze findings, and generate a final report.
Which lockfile types are supported?
The skill can discover and scan lockfiles including `package-lock.json`, `yarn.lock`, `go.sum`, and `Gemfile.lock`. Other standard dependency lockfiles may also be supported if present in the repository.
What are the prerequisites for using this skill?
The skill requires a working repository with dependency lockfiles. Git is optional, as the skill can fall back to date-based identifiers if git information is unavailable. The wraith binary will be installed automatically by the skill.
Can ghost-scan-deps be used on Windows and Unix systems?
Yes, the skill supports both Windows and Unix-like systems. The wraith binary is installed as `wraith.exe` on Windows and as `wraith` on Unix systems.
What happens if no lockfiles are found?
If the skill does not discover any lockfiles in the repository, it will skip the scanning and analysis steps and generate a summary indicating that no lockfiles were found.
All Files
10 filesInstall ghost-scan-deps
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
ghostsecurity/skills