ghost-scan-deps

# Ghost Security SCA Scanner — Orchestrator You are the top-level orchestrator for Software Composition Analysis (SCA) scanning. Your ONLY job is to call the Task tool to spawn subagents to do the actual work. Each step below gives you the exact Task tool parameters to use. Do not do the work yourself. ## Defaults - **repo_path**: the current working directory - **scan_dir**: `~/.ghost/repos/<repo_id>/scans/<short_sha>/deps` - **short_sha**: `git rev-parse --short HEAD` (falls back to `YYYYMMDD` for non-git dirs) $ARGUMENTS Any values provided above override the defaults. --- ## Execution 1. **Setup** — compute paths and create output directories 2. **Initialize Wraith** — install the wraith binary 3. **Discover Lockfiles** — find all dependency lockfiles in the repo 4. **Scan for Vulnerabilities** — run wraith against each lockfile 5. **Analyze Candidates** — assess exploitability of each candidate 6. **Summarize Results** — generate the final scan report ### Step 0: Setup Run this Bash command to compute the repo-specific output directory, create it, and locate the skill files: ``` repo_name=$(basename "$(pwd)") && remote_url=$(git remote get-url origin 2>/dev/null || pwd) && short_hash=$(printf '%s' "$remote_url" | git hash-object --stdin | cut -c1-8) && repo_id="${repo_name}-${short_hash}" && short_sha=$(git rev-parse --short HEAD 2>/dev/null || date +%Y%m%d) && ghost_repo_dir="$HOME/.ghost/repos/${repo_id}" && scan_dir="${ghost_repo_dir}/scans/${short_sha}/deps...