# GitHub Actions Security Review

> GitHub Actions Security Review is a paid API for AI agents from api.aiskills402.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-20).

Reviews a GitHub Actions workflow YAML file for the five critical security vulnerabilities that allow outsiders to execute code or exfiltrate secrets from a CI/CD pipeline

## Facts

- Endpoint: GET https://api.aiskills402.com/v1/skills/github-actions-security-review/file?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-20
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/github-actions-security-review-ae03042c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hr52jjI4fEhJTrYli96ZD

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability github-actions-security-review-ae03042c
```

Example prompt: Can you review this GitHub Actions workflow YAML for security vulnerabilities — specifically things like script injection from issue text, dangerous pull_request_target checkouts, or steps that could expose secrets to untrusted code?

## When to prefer this

Choose this endpoint when you specifically need a focused, fast security review of a GitHub Actions workflow YAML targeting the five highest-impact vulnerability classes (script injection, pull_request_target misuse, workflow_run artifact abuse, excessive token permissions, unpinned actions). It is ideal for pre-merge CI audits, open-source maintainers reviewing contributor PRs, or DevSecOps pipelines that need a cheap, deterministic signal. Prefer it over general-purpose code review tools when you want opinionated, actionable output scoped strictly to GitHub Actions pipeline security rather than broad static analysis.

## Known failure modes

- Input is not a valid GitHub Actions YAML file — returns an error or irrelevant output
- Workflow file is too large or complex for the review scope
- Non-YAML content submitted (e.g. raw JSON or Dockerfile) — may produce empty or incorrect results
- Network or payment authorization failure returns a 402 or 5xx error
- Only the five specific vulnerability classes are checked; other security issues outside this scope will not be reported

## How this service works

GitHub Actions Security Review — Reviews ONE GitHub Actions workflow file (YAML) for the five mistakes that let an outsider run code or read secrets in your pipeline, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches text from an issue, pull request, comment or branch name pasted straight into a shell step, a pull_request_target or workflow_run job that checks out and runs the code of the pull request, a third-…

## Output

A concise list of security findings, each with a fixed vulnerability code, the exact location in the workflow file, an explanation of why it is dangerous, and a concrete fix — or exactly 'No findings' if the workflow is clean. Covers five critical vulnerability classes: script injection from untrusted text, dangerous pull_request_target checkouts, unsafe workflow_run artifact usage, overly permissive token scopes, and unpinned third-party actions.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD"
     ],
     "type": "string"
    },
    "headers": {
     "type": "object",
     "additionalProperties": {
      "type": "string"
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/github-actions-security-review-ae03042c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.aiskills402.com](https://www.zero.xyz/host/api.aiskills402.com/llms.txt)