# GitHub Actions Workflow Security Linter

> GitHub Actions Workflow Security Linter is a paid API for AI agents from ciaudit.genexxis.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Audits a GitHub Actions workflow file for common security misconfigurations and vulnerabilities, returning scored findings with severity, fix suggestions, and affected lines.

## Facts

- Endpoint: POST https://ciaudit.genexxis.com/github-actions?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/github-actions-workflow-security-linter-e827fae5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_GDqdALBSe0k8wk3wzXe70

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability github-actions-workflow-security-linter-e827fae5 -d '<json body>'
```

Example prompt: Can you audit my GitHub Actions workflow for security issues — here's the full YAML content — and tell me what's misconfigured, the severity of each finding, and how to fix it?

## When to prefer this

Use this endpoint when you need automated, structured security feedback on a GitHub Actions workflow file specifically — it covers a targeted set of CI/CD security checks (pinning, permissions, injection, secrets, curl|bash, self-hosted runners, deprecated commands) with per-finding fix guidance and a numeric score. Prefer this over generic SAST tools when you want fast, cheap, focused CI-security linting without setting up a full scanning pipeline.

## Known failure modes

- Workflow YAML exceeds 100 KB limit — content will be rejected
- Malformed or non-YAML content submitted — may produce empty or incorrect findings
- Non-GitHub-Actions YAML (e.g. GitLab CI, CircleCI) — may misclassify or return irrelevant results
- Payment failure via x402 protocol — request not processed
- Network timeout for very complex workflows

## How this service works

Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.

## Output

Returns a JSON object containing: a numeric security score (0-100), a summary of findings broken down by severity (high/medium/low/total), a list of detailed findings each with an ID, severity, why it matters, a specific fix suggestion, the affected line number, and a code snippet. Also includes the list of workflow triggers and job names detected.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "content": {
   "type": "string",
   "description": "Full text of the file (max 100 KB)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "jobs": [
   "test"
  ],
  "kind": "github-actions",
  "score": 76,
  "summary": {
   "low": 0,
   "high": 0,
   "total": 3,
   "medium": 3
  },
  "findings": [
   {
    "id": "no_permissions",
    "fix": "Add at top level: permissions: { contents: read }",
    "why": "no top-level permissions: the GITHUB_TOKEN gets the repository default",
    "line": null,
    "snippet": null,
    "severity": "medium"
   },
   {
    "id": "unpinned_action",
    "fix": "Pin to a full commit SHA",
    "why": "actions/checkout is referenced by a mutable tag/branch",
    "line": 10,
    "snippet": "- uses: actions/checkout@v4",
    "severity": "medium"
   }
  ],
  "triggers": [
   "push",
   "pull_request"
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/github-actions-workflow-security-linter-e827fae5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ciaudit.genexxis.com](https://www.zero.xyz/host/ciaudit.genexxis.com/llms.txt)