report

Name: report
Author: ghostsecurity

399stars27forks

How to install report?

ghostsecurity/skills/report

$npx -y skills add ghostsecurity/skills --skill report

Installs into the current project.

Summary

Ghost Security — combined security report. Aggregates findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report focused on the highest risk, highest confidence issues. Use when the user requests a security overview, vulnerability summary,

Files · 1

View on GitHub

SKILL.md

1	# Combined Security Report
2
3	You aggregate findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report. Do all work yourself — do not spawn subagents or delegate.
4
5	$ARGUMENTS
6
7	---
8
9	## Step 0: Setup
10
11	Run this Bash command to compute paths:
12	```bash
13	repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null \|\| pwd) && short_hash=$(printf '%s' "$remote_url" \| git hash-object --stdin \| cut -c1-8) && repo_id="${repo_name}-${short_hash}" && short_sha=$(git rev-parse --short HEAD 2>/dev/null \|\| date +%Y%m%d) && ghost_repo_dir="$HOME/.ghost/repos/${repo_id}" && scans_dir="${ghost_repo_dir}/scans/${short_sha}" && cache_dir="${ghost_repo_dir}/cache" && skill_dir=$(find . -path '*/skills/report/SKILL.md' 2>/dev/null \| head -1 \| xargs dirname) && echo "scans_dir=$scans_dir cache_dir=$cache_dir skill_dir=$skill_dir"
14	```
15
16	Store `scans_dir` (commit-level scan directory), `cache_dir`, and `skill_dir`.
17
18	---
19
20	## Cache Check
21
22	If `<scans_dir>/report.md` already exists, show:
23
24	```
25	Combined security report is at: <scans_dir>/report.md
26	```
27
28	And stop. Do not regenerate it.
29
30	---
31
32	## Step 1: Read Repo Context
33
34	Read `<cache_dir>/repo.md` if it exists. Extract:
35	- Business criticality
36	- Sensitive data types
37	- Component map
38
39	If it does not exist, continue without it — this is not an error.
40
41	---
42
43	## Step 2: Discover Scan Results
44
45	List the contents of `<scans_dir>` to see which scan-type directories exist. Recognized types:
46	- `deps/` — SCA / dependency vulnerability scan
47	- `secrets/` — secrets and credentials scan
48	- `code/` — code security scan (SAST)
49
50	If none of these directories exist, report an error:
51
52	```
53	No scan results found in <scans_dir>. Run one or more scan skills first:
54	/ghost-scan-deps
55	/ghost-scan-secrets
56	/ghost-scan-code
57	```
58
59	And stop.
60
61	---
62
63	## Step 3: Collect Findings
64
65	For each scan type that exists, glob `<scans_dir>/<type>/findings/.md` and read each finding file in full*. Retain the complete markdown body of every finding — the report will inline this content directly so readers never need to open individual finding files.
66
67	From each finding, also extract these metadata fields for filtering and sorting:
68
69	- ID — from `## Metadata` → `ID`
70	- Type — the scan type (`deps`, `secrets`, or `code`)
71	- Severity — from `## Metadata` → `Severity` (high, medium, low)
72	- Status — from `## Metadata` → `Status` (e.g., confirmed-exploitable, unverified, verified, rejected, clean)
73
74	---
75
76	## Step 4: Filter and Sort
77
78	Filter: Keep only high-confidence findings:
79	- For `deps` findings: status is `confirmed-exploitable`
80	- For `secrets` findings: status is NOT `clean` and NOT `rejected`
81	- For `code` findings: status is `verified` or `unverified` (NOT `rejected`)
82
83	Exclude any finding with status `clean`, `rejected`, or `false-positive`.
84
85	Sort the remaining findings:
86	1. By severity: high first, then medium, then low
87	2. Within same severity: deps before secrets before code
88
89	---
90
91	## Step 5: Read Per-Scan Reports
92
93	For `deps` and `secrets` scan types, read `<scans_dir>/<type>/report.md` if present. Extract:
94	- Statistics (candidates scanned, confirmed findings, false positives filtered)
95	- Executive summary highlights
96
97	Note: `code` does not produce a `report.md`. For code scan coverage, count the finding files in `<scans_dir>/code/findings/` directly. The "Candidates Scanned" count is the total number of finding files (all statuses). "Confirmed Findings" is the count with status `verified`, `confirmed`, or `unverified`. "False Positives Filtered" is the count with status `rejected`. Do NOT count clean file analyses from the nomination/analysis funnel — those never became findings.
98
99	If a per-scan report does not exist for deps or secrets, note it as unavailable.
100
101	---
102
103	## Step 6: Generate Report
104
105	1. Read `<skill_dir>/report-template.md`
106	2. Populate the template with collected data:
107	- Fill Scan Information with repository name, commit SHA, date, and which scans ran
108	- Write Executive Summary using repo context and aggregated findings
109	- For all writing elements in this security-focused, objective and fact based report, use a neutral, human tone that balances expertise with ease of reading. Do not use emojis, em-dashes, etc.
110	- For Critical & High findings (severity = high): inline the substantive content from each finding file directly into the report — include code snippets, assessment tables, remediation commands, and all relevant detail so the report is fully self-contained
111	- For Med

People who liked this also viewed

6 picks

Type

report

399stars27forks

View on GitHub

How to install report?

ghostsecurity/skills/report

$npx -y skills add ghostsecurity/skills --skill report

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Combined Security Report
2
3	You aggregate findings from all scan skills (scan-deps, scan-secrets, scan-code) into a single prioritized report. Do all work yourself — do not spawn subagents or delegate.
4
5	$ARGUMENTS
6
7	---
8
9	## Step 0: Setup
10
11	Run this Bash command to compute paths:
12	```bash
13	repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null \|\| pwd) && short_hash=$(printf '%s' "$remote_url" \| git hash-object --stdin \| cut -c1-8) && repo_id="${repo_name}-${short_hash}" && short_sha=$(git rev-parse --short HEAD 2>/dev/null \|\| date +%Y%m%d) && ghost_repo_dir="$HOME/.ghost/repos/${repo_id}" && scans_dir="${ghost_repo_dir}/scans/${short_sha}" && cache_dir="${ghost_repo_dir}/cache" && skill_dir=$(find . -path '*/skills/report/SKILL.md' 2>/dev/null \| head -1 \| xargs dirname) && echo "scans_dir=$scans_dir cache_dir=$cache_dir skill_dir=$skill_dir"
14	```
15
16	Store `scans_dir` (commit-level scan directory), `cache_dir`, and `skill_dir`.
17
18	---
19
20	## Cache Check
21
22	If `<scans_dir>/report.md` already exists, show:
23
24	```
25	Combined security report is at: <scans_dir>/report.md
26	```
27
28	And stop. Do not regenerate it.
29
30	---
31
32	## Step 1: Read Repo Context
33
34	Read `<cache_dir>/repo.md` if it exists. Extract:
35	- Business criticality
36	- Sensitive data types
37	- Component map
38
39	If it does not exist, continue without it — this is not an error.
40
41	---
42
43	## Step 2: Discover Scan Results
44
45	List the contents of `<scans_dir>` to see which scan-type directories exist. Recognized types:
46	- `deps/` — SCA / dependency vulnerability scan
47	- `secrets/` — secrets and credentials scan
48	- `code/` — code security scan (SAST)
49
50	If none of these directories exist, report an error:
51
52	```
53	No scan results found in <scans_dir>. Run one or more scan skills first:
54	/ghost-scan-deps
55	/ghost-scan-secrets
56	/ghost-scan-code
57	```
58
59	And stop.
60
61	---
62
63	## Step 3: Collect Findings
64
65	For each scan type that exists, glob `<scans_dir>/<type>/findings/.md` and read each finding file in full*. Retain the complete markdown body of every finding — the report will inline this content directly so readers never need to open individual finding files.
66
67	From each finding, also extract these metadata fields for filtering and sorting:
68
69	- ID — from `## Metadata` → `ID`
70	- Type — the scan type (`deps`, `secrets`, or `code`)
71	- Severity — from `## Metadata` → `Severity` (high, medium, low)
72	- Status — from `## Metadata` → `Status` (e.g., confirmed-exploitable, unverified, verified, rejected, clean)
73
74	---
75
76	## Step 4: Filter and Sort
77
78	Filter: Keep only high-confidence findings:
79	- For `deps` findings: status is `confirmed-exploitable`
80	- For `secrets` findings: status is NOT `clean` and NOT `rejected`
81	- For `code` findings: status is `verified` or `unverified` (NOT `rejected`)
82
83	Exclude any finding with status `clean`, `rejected`, or `false-positive`.
84
85	Sort the remaining findings:
86	1. By severity: high first, then medium, then low
87	2. Within same severity: deps before secrets before code
88
89	---
90
91	## Step 5: Read Per-Scan Reports
92
93	For `deps` and `secrets` scan types, read `<scans_dir>/<type>/report.md` if present. Extract:
94	- Statistics (candidates scanned, confirmed findings, false positives filtered)
95	- Executive summary highlights
96
97	Note: `code` does not produce a `report.md`. For code scan coverage, count the finding files in `<scans_dir>/code/findings/` directly. The "Candidates Scanned" count is the total number of finding files (all statuses). "Confirmed Findings" is the count with status `verified`, `confirmed`, or `unverified`. "False Positives Filtered" is the count with status `rejected`. Do NOT count clean file analyses from the nomination/analysis funnel — those never became findings.
98
99	If a per-scan report does not exist for deps or secrets, note it as unavailable.
100
101	---
102
103	## Step 6: Generate Report
104
105	1. Read `<skill_dir>/report-template.md`
106	2. Populate the template with collected data:
107	- Fill Scan Information with repository name, commit SHA, date, and which scans ran
108	- Write Executive Summary using repo context and aggregated findings
109	- For all writing elements in this security-focused, objective and fact based report, use a neutral, human tone that balances expertise with ease of reading. Do not use emojis, em-dashes, etc.
110	- For Critical & High findings (severity = high): inline the substantive content from each finding file directly into the report — include code snippets, assessment tables, remediation commands, and all relevant detail so the report is fully self-contained
111	- For Med

People who liked this also viewed

6 picks

Type