GitHub Actions security scanner: pin actions to SHAs, detect script injection, audit permissions. Fix supply chain vulnerabilities.
This action scans your repository's workflows for uses: references, checks the GitHub API for each action's latest release, and reports version drift or insecure tag pinning (e.g., pinning to v1 instead of a commit SHA).
One GitHub Action that runs zizmor, skillxray, a fork-PR checkout check, and a secrets scan as a single pass or fail gate.
Local web app and CLI that maps GitHub Actions workflow blast radius from real YAML: triggers, permissions, actions, secrets, and fixes
MCP server that statically scans n8n automation workflows for security issues (SAST for n8n): SSRF/IMDS, code injection, unauth webhooks, hardcoded secrets, PII egress. Includes STRIDE threat model.
AEAP Composition Boundary Adapter for the Microsoft Agent Framework (Python). Thin wrapper that attaches the AEAP Runtime Decision Point to agent middleware and workflow execution. Published as aiyoplane-microsoft-agent-framework on PyPI.
AEAP Composition Boundary Adapter for CrewAI. Thin wrapper that attaches the AEAP Runtime Decision Point to CrewAI tool invocations by any crew member. Published as aiyoplane-crewai on PyPI.
Read-only GitHub Actions security linter for unsafe triggers, permissions, secrets, checkouts, runners, and unpinned actions.
Static security scanner for GitHub Actions workflows — 10 rules mapped to the OWASP Top 10 CI/CD risks.
AEAP Composition Boundary Adapter for Google ADK. Thin wrapper that attaches the AEAP Runtime Decision Point to agent tool invocations — code execution, external APIs, cloud resources. Published as aiyoplane-google-adk on PyPI.
GitHub Actions security scanner powered by OpenSSF Scorecard. Scan repositories, organizations, and user accounts for workflow vulnerabilities. Generate beautiful HTML, JSON, CSV, and Markdown reports with risk scoring and actionable insights.
Static security and reliability checks for GitHub Actions workflows
Follows an untrusted GitHub Actions value after it leaves run:, through env:, with:, step outputs and into the called action, until it dies in argv, reaches a shell, spoofs GITHUB_OUTPUT, or becomes opaque with the reason named. An injection that moved is not an injection that was fixed.
AEAP Composition Boundary Adapter for LangChain (Python). Thin wrapper that attaches the AEAP Runtime Decision Point to LangChain tool invocations. Published as aiyoplane-langchain on PyPI.
Pre-commit security scanner for GitHub Actions workflows
To associate your repository with the workflow-security topic, visit your repo's landing page and select "manage topics."