ghost-scan-code 是做什麼的？
Ghost Security - SAST 程式碼安全掃描器。透過規劃並執行針對 SQL 注入、XSS、BOLA、BFLA、SSRF 及其他 OWASP 類別的目標掃描，在原始碼中找出安全漏洞。支援應用程式（後端、前端、行動裝置）和程式庫（原型污染、不安全的反序列化、ReDoS、路徑遍歷、Zip Slip）。當使用者要求進行程式碼安全稽核、SAST 掃描、原始碼漏洞掃描，或想在程式庫或原始碼中找出安全缺陷時使用。
Ghost Security - SAST 程式碼安全掃描器。透過規劃並執行針對 SQL 注入、XSS、BOLA、BFLA、SSRF 及其他 OWASP 類別的目標掃描，在原始碼中找出安全漏洞。
此技能為 Ghost Security 提供的 SAST 程式碼安全掃描器，適用於所有主流的 AI 代理平台（如 Claude Code、Cursor、Codex 等）。其主要功能是透過分析原始碼，自動規劃並執行安全掃描，以偵測 SQL 注入、跨站腳本攻擊（XSS）、物件等級授權缺失（BOLA）、功能等級授權缺失（BFLA）、伺服器端請求偽造（SSRF）等多種 OWASP 類別漏洞。技能支援後端、前端、行動應用程式，以及程式庫（如原型污染、不安全的反序列化、ReDoS、路徑遍歷、Zip Slip 等）。使用時機為使用者要求進行程式碼安全稽核、SAST 掃描、原始碼漏洞掃描，或想在程式庫中尋找安全缺陷時。其運作方式基於 SKILL.md 文件中的指引，可因應複雜場景進行深度掃描。
npx skills add https://github.com/ghostsecurity/skills/tree/main/skills/ghost-scan-codeInstalled? Explore more 程式設計與開發 skills: steipete/bluebubbles, steipete/eightctl, steipete/blucli · View all 6 →
Ghost Security - SAST 程式碼安全掃描器。透過規劃並執行針對 SQL 注入、XSS、BOLA、BFLA、SSRF 及其他 OWASP 類別的目標掃描，在原始碼中找出安全漏洞。支援應用程式（後端、前端、行動裝置）和程式庫（原型污染、不安全的反序列化、ReDoS、路徑遍歷、Zip Slip）。當使用者要求進行程式碼安全稽核、SAST 掃描、原始碼漏洞掃描，或想在程式庫或原始碼中找出安全缺陷時使用。
This repo contains 6 individual skills — each has its own dedicated page.
Starts and controls the reaper MITM proxy to capture, inspect, search, and replay HTTP/HTTPS traffic between clients and servers. Capabilities include starting/stopping the proxy scoped to specific domains, viewing captured request/response logs, searching traffic by method/path/status/host, and inspecting full raw HTTP entries for security analysis. Use when the user asks to "start the proxy", "capture traffic", "intercept requests", "inspect HTTP traffic", "search captured requests", or "view request/response".
Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis.
Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary, full security audit, or combined scan results.
Ghost Security - Software Composition Analysis (SCA) scanner. Scans dependency lockfiles for known vulnerabilities, identifies CVEs, and generates findings with severity levels and remediation guidance. Use when the user asks about dependency vulnerabilities, vulnerable packages, CVE checks, security audits of dependencies, or wants to scan lockfiles like package-lock.json, yarn.lock, go.sum, or Gemfile.lock.
Ghost Security - Secrets and credentials scanner. Scans codebase for leaked API keys, tokens, passwords, and sensitive data. Detects hardcoded secrets and generates findings with severity and remediation guidance. Use when the user asks to check for leaked secrets, scan for credentials, find hardcoded API keys or passwords, detect exposed .env values, or audit code for sensitive data exposure.
This skill should be used when the user asks to "validate a finding", "check if a vulnerability is real", "triage a security finding", "confirm a vulnerability", "determine if a finding is a true positive or false positive", or provides a security finding for review. It validates security vulnerability findings by tracing data flows, verifying exploit conditions, analyzing security controls, and optionally testing attack vectors against a live application.
Send and manage iMessages via BlueBubbles, including attachments, tapbacks, edits, replies, and groups.
Control Eight Sleep pods (status, temperature, alarms, schedules).
BluOS CLI (blu) for discovery, playback, grouping, and volume.
Create, search, and manage Bear notes via grizzly CLI.
Capture frames or clips from RTSP/ONVIF cameras.
Search GIF providers with CLI/TUI, download results, and extract stills/sheets.