Task wording matches this skill metadata.

• Evaluate ghost-scan-deps before installing it in an agent workflow
• security
• Security and compliance workflows; Claude Code teams; builders willing to evaluate younger projects

Install handoff is available.

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

standard package or runtime install path

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

Good trust signals with a few areas worth checking before rollout.

• Strong shortlist
• 405 GitHub stars
• apache-2.0

Needs review

• The skill installs the wraith binary via `curl ... | bash`, which executes remote code. While the script is from the same organization, this is a supply chain risk that could be mitigated by pinning a specific version or using a checksum verification.

Sparse or mixed signals. Useful for discovery, but not for autonomous installation.

• Test manually in an isolated workspace and compare against safer alternatives.
• High-risk permission hints: Shell or command execution

apache-2.0

• apache-2.0

shell or command execution, filesystem or document access

• Shell or command execution: high
• Network access: medium
• Filesystem access: medium

Task wording matches this skill metadata.

• Evaluate ghost-scan-deps before installing it in an agent workflow
• security
• Security and compliance workflows; Claude Code teams; builders willing to evaluate younger projects

Install handoff is available.

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

standard package or runtime install path

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

Good trust signals with a few areas worth checking before rollout.

• Strong shortlist
• 405 GitHub stars
• apache-2.0

Needs review

• The skill installs the wraith binary via `curl ... | bash`, which executes remote code. While the script is from the same organization, this is a supply chain risk that could be mitigated by pinning a specific version or using a checksum verification.

Sparse or mixed signals. Useful for discovery, but not for autonomous installation.

• Test manually in an isolated workspace and compare against safer alternatives.
• High-risk permission hints: Shell or command execution

apache-2.0

• apache-2.0

shell or command execution, filesystem or document access

• Shell or command execution: high
• Network access: medium
• Filesystem access: medium

Task wording matches this skill metadata.

• Evaluate ghost-scan-deps before installing it in an agent workflow
• security
• Security and compliance workflows; Claude Code teams; builders willing to evaluate younger projects

Install handoff is available.

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

standard package or runtime install path

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

Good trust signals with a few areas worth checking before rollout.

• Strong shortlist
• 405 GitHub stars
• apache-2.0

Needs review

• The skill installs the wraith binary via `curl ... | bash`, which executes remote code. While the script is from the same organization, this is a supply chain risk that could be mitigated by pinning a specific version or using a checksum verification.

Sparse or mixed signals. Useful for discovery, but not for autonomous installation.

• Test manually in an isolated workspace and compare against safer alternatives.
• High-risk permission hints: Shell or command execution

apache-2.0

• apache-2.0

shell or command execution, filesystem or document access

• Shell or command execution: high
• Network access: medium
• Filesystem access: medium

Task wording matches this skill metadata.

• Evaluate ghost-scan-deps before installing it in an agent workflow
• security
• Security and compliance workflows; Claude Code teams; builders willing to evaluate younger projects

Install handoff is available.

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

standard package or runtime install path

• npx skills add ghostsecurity/skills --skill ghost-scan-deps

Good trust signals with a few areas worth checking before rollout.

• Strong shortlist
• 405 GitHub stars
• apache-2.0

Needs review

• The skill installs the wraith binary via `curl ... | bash`, which executes remote code. While the script is from the same organization, this is a supply chain risk that could be mitigated by pinning a specific version or using a checksum verification.

Sparse or mixed signals. Useful for discovery, but not for autonomous installation.

• Test manually in an isolated workspace and compare against safer alternatives.
• High-risk permission hints: Shell or command execution

apache-2.0

• apache-2.0

shell or command execution, filesystem or document access

• Shell or command execution: high
• Network access: medium
• Filesystem access: medium