Ghost Report
Merges scan-deps, secrets, and code findings into one prioritized security report
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 21, 2026
- Environment
- Claude Code 2.x (agent harness)
⚠ This skill is no longer available upstream. Our re-check on Aug 10, 2026 couldn't find it any more (SKILL.md not found in repo tree). The test below is what we measured on Jul 21, 2026 and we're leaving it up as a record — but there is nothing left to install, so we've removed the command.
Fetched SKILL.md at plugins/ghost/skills/report/; frontmatter parses with name+description, its one referenced file report-template.md returns HTTP 200, paths derive from $HOME/.ghost with no hardcoded machine paths and no security smells (the Step 0 Bash is a benign git hash-object call). To test output I hand-built a scans dir with six finding files (deps/secrets/code, mixed statuses) plus per-scan reports and repo.md, then produced a naive baseline aggregation vs a report following Steps 3-6 strictly. Concrete difference: the baseline surfaced sec-002 (clean) and code-002 (rejected) as real findings, while the skill's Step 4 filter correctly excluded both, sorted high-before-medium and deps->secrets->code, inlined code/remediation, and added a Scan Coverage statistics table the baseline lacked (16 vs 119 lines). Trigger judgments were 5/5. Note: the skill is useless standalone and requires the three sibling scan skills' output, which I simulated rather than generating via real scans.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 8/10
- Docs & honesty 4/5
What Ghost Report does
Aggregates findings written by the Ghost scan skills (scan-deps, scan-secrets, scan-code) from ~/.ghost/repos into a single prioritized markdown report, filtering out clean and rejected findings and inlining code, remediation, and a scan-coverage table. Triggers when the user asks for a combined security report, vulnerability summary, or full security audit after running the scan skills. Requires the sibling scan skills to have produced output first; it errors with guidance if no scan results are found.
How to install Ghost Report
Nothing to install: the source repository no longer has this skill. If the author brings it back, our daily re-check will pick it up and the command will reappear here.
Commands — how to trigger Ghost Report
-
/ghost-reportMerges scan-deps, secrets, and code findings into one prioritized security report
It also activates on plain-language prompts like these:
-
Generate a combined security report for this repo -
Summarize all our scan findings by risk -
Give me a full security audit overview
Frequently asked questions
- Is the Ghost Report skill free?
- Yes. The skill itself is free from ghostsecurity/skills. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Ghost Report work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Tested · Works. Fetched SKILL.md at plugins/ghost/skills/report/; frontmatter parses with name+description, its one referenced file report-template.md returns HTTP 200, paths derive from $HOME/.ghost with no hardcoded machine paths and no security smells (the Step 0 Bash is a benign git hash-object call). To test output I hand-built a scans dir with six finding files (deps/secrets/code, mixed statuses) plus per-scan reports and repo.md, then produced a naive baseline aggregation vs a report following Steps 3-6 strictly. Concrete difference: the baseline surfaced sec-002 (clean) and code-002 (rejected) as real findings, while the skill's Step 4 filter correctly excluded both, sorted high-before-medium and deps->secrets->code, inlined code/remediation, and added a Scan Coverage statistics table the baseline lacked (16 vs 119 lines). Trigger judgments were 5/5. Note: the skill is useless standalone and requires the three sibling scan skills' output, which I simulated rather than generating via real scans.
- What is the Ghost Report SkillProof Score?
- 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.
- How do I install Ghost Report?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Ghost Report with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.