ghostsecurity/skills

Ghost Security's collection of AppSec skills for AI coding agents

What it solves

Ghost Security Skills provides a set of application security (AppSec) tools and AI-driven orchestration for Claude Code, enabling AI coding agents to identify, validate, and fix security vulnerabilities within a developer's existing workflow.

How it works

The project uses a two-layer architecture that combines deterministic security tools with AI reasoning:

  1. Deterministic Tools: Standalone Go binaries (Poltergeist for secrets, Wraith for dependencies, Reaper for live traffic) provide ground-truth data through pattern matching, CVE lookups, and traffic captures.
  2. AI Skills Layer: Orchestration prompts that use AI to analyze the tool outputs, assess exploitability, and provide context-aware judgment on whether a finding is a real vulnerability or a benign artifact.

This creates a "find, validate, fix" loop where scanners find candidates, AI analyzes them, and the agent applies remediation guidance.

Who it’s for

Developers and security engineers using Claude Code who want to integrate automated security scanning and vulnerability remediation directly into their AI-assisted coding environment.

Highlights

  • Integrated Toolset: Includes Poltergeist (secret scanning), Wraith (dependency scanning), and Reaper (MITM HTTPS proxy for live validation).
  • AI-Powered Analysis: Uses AI to reduce noise by assessing the exploitability and context of findings.
  • Agent-Native: Specifically designed as a plugin marketplace for Claude Code.
  • Composable: Tools can be used as standalone binaries or as part of the AI-orchestrated pipeline.
  • Exo Integration: Includes the ghost-exo skill for building and debugging workflows on the exo agent orchestration platform.

Related

  • Project
    feiskyer/claude-code-settings

    A set of Claude Code plugins (skills & sub‑agents) that add brainstorming, deep research, GitHub issue/PR automation, image generation, translation, and more, with ready‑made config files for many LLM providers.

  • Project
    karanb192/claude-code-hooks

    A marketplace of 22 safety‑and‑automation plugins (hooks) for Claude Code, letting you block dangerous commands, protect secrets, audit sessions, auto‑format code, and more, all installed via simple Claude commands.

  • Project
    majiayu000/claude-skill-registry

    A searchable, daily‑updated catalog of Claude Code plugins with web UI, CLI (`sk`), and JSON API; includes security scanning, deduplication, and a canonical taxonomy.

  • Project
    trailofbits/skills

    A marketplace of specialized plugins for AI coding assistants that adds expert-level security auditing, vulnerability research, and advanced development workflows to agents like Claude Code.

  • Project
    posit-dev/skills

    Posit Agent Skills is a collection of reusable plug‑ins (Agent Skills) that extend AI coding assistants (Claude Code, Posit Assistant, etc.) with domain‑specific workflows such as code review, PR handling, R package release, Shiny theming, and Quarto authoring. Install via `npx skills add`, and the assistant will automatically activate the right skill based on your task.