A security scanner that
runs on your machine, not on ours.
Ghost Trap Cybernetics checks a device for concrete signs of compromise or misconfiguration — persistence mechanisms, tampered system files, suspicious listeners, privilege-escalation vectors — and offers safe, reversible fixes you confirm each time. A plain scan never changes anything, and nothing ever leaves your machine.
Get it
Linux & ChromeOS (Crostini)
ReadyDetails
The primary, fully-tested target — this is the only platform with real malware detection (ClamAV + YARA) and the reversible --fix engine. Install with sudo dpkg -i in the Linux terminal on ChromeOS Crostini (or its "Baguette" successor) or any Debian/Ubuntu-based Linux — Google is phasing out the Files-app double-click .deb install on ChromeOS, so the terminal command is the one to rely on. Sets up the CLI, the local web app, and an app-drawer icon — built and kept current automatically by CI. Prefer to build from source instead?
git clone https://github.com/Ghost-N-The-Shell/ghost-trap-cybernetics.git
cd ghost-trap-cybernetics
./install.sh
ghost-trap-cybernetics # run a scan
ghost-trap-cybernetics-app # open the local web UImacOS
Implemented, not hardware-verifiedDetails
7 checks implemented and unit-tested (world-writable files, SUID/SGID audit, a DYLD_INSERT_LIBRARIES hijack check, cron/shell-rc persistence, LaunchAgents/LaunchDaemons, listening ports via lsof, Chrome/Chromium managed-policy tampering). This .dmg is built by CI on an actual Mac runner and kept current automatically, but hasn't run on real Mac hardware yet, and isn't code-signed or notarized — expect a Gatekeeper "unrecognized developer" warning on first run. Findings are report-only; --fix isn't available on this platform yet.
Windows
Implemented, not hardware-verifiedDetails
6 checks implemented and unit-tested (Run/RunOnce registry keys, the Startup folder, AppInit_DLLs, listening ports via netstat, non-Microsoft Scheduled Tasks, WMI event-subscription persistence). This installer (Inno Setup) is built by CI on an actual Windows runner and kept current automatically, but hasn't run on real Windows hardware yet, and isn't code-signed — expect a SmartScreen "unrecognized publisher" warning on first run.
Android
Implemented, not hardware-verifiedDetails
A genuinely different app, not a port — Android's sandboxing means there's no system filesystem to audit, so it checks device posture (screen lock, USB debugging, root indicators, active VPN) and per-app risk signals (sideloaded install source, overlay permission, accessibility/notification-listener access, QUERY_ALL_PACKAGES) instead. Report-only, same as macOS/Windows; built and kept current automatically by CI, not yet verified on a real device. Your phone will warn about installing from an unknown source the first time — that's expected until this is on the Play Store.
Chrome extension
Ready1. Download and unzip ghost-trap-cybernetics-extension.zip above
2. Open chrome://extensions
3. Enable "Developer mode" (top right)
4. Click "Load unpacked" and select the unzipped folderDetails
Checks browser-level risk (risky extensions, proxy hijacking, disabled Safe Browsing, dangerous downloads) directly in Chrome — works in any Chrome-based browser, not just ChromeOS. Manifest V3, packaged the same way the Chrome Web Store requires — not listed there yet, so for now it needs Developer mode to load.
What it checks
🔓 Permissions & privilege escalation
World-writable system files, unexpected SUID/SGID binaries.
🔁 Persistence mechanisms
Cron, shell startup files, XDG autostart entries, LaunchAgents/Daemons, Registry Run keys, the Startup folder, Scheduled Tasks, and fileless WMI event subscriptions.
🪝 Hijacking & injection
LD_PRELOAD / DYLD_INSERT_LIBRARIES / AppInit_DLLs — the Linux, macOS, and Windows versions of the same trick.
👻 Hidden processes
Processes still running from a binary that's been deleted off disk.
🌐 Listening ports
Unexpected sockets accepting incoming connections.
🧩 Browser policy tampering
A system-level Chrome/Chromium managed-policy file silently disabling Safe Browsing or force-installing an extension the user can't remove.
🧬 Real malware detection
ClamAV signatures and a curated YARA ruleset — a concrete signature match, not a guess — plus on-access scanning of new files the instant they land (Linux).
Safety model
- A plain scan is read-only and changes nothing on your machine.
- Fixes are always reversible — a permission bit, a backed-up file, a cleared setting — and never a permanent delete. Flagged files are moved to a locked recovery folder you can restore from.
- Nothing is fixed without your explicit confirmation, every time.
- Everything runs locally. There is no server this tool talks to, no account, no telemetry — the local web app binds to 127.0.0.1 only, so nothing off your machine can reach it.