# GitHub Actions Workflow Security Scanner

> GitHub Actions Workflow Security Scanner is a paid API for AI agents from x402-hono-api.inraby.workers.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Scans GitHub Actions workflow YAML for security vulnerabilities including pull_request_target misuse, over-permissive tokens, secret leakage, unpinned actions, and unsafe fork checkout patterns

## Facts

- Endpoint: POST https://x402-hono-api.inraby.workers.dev/api/v1/github-actions-secret-exposure-scan
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/github-actions-workflow-security-scanner-51ff4c8c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_u8V3uX1ePwsSZsCcf_uUE

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability github-actions-workflow-security-scanner-51ff4c8c -d '<json body>'
```

Example prompt: Can you scan this GitHub Actions workflow YAML for security issues — specifically check for pull_request_target misuse, over-permissive tokens, any secrets that might be leaking, unpinned actions, and unsafe fork checkout patterns?

## When to prefer this

Use this endpoint when you need automated static analysis of GitHub Actions workflow files specifically for CI/CD security anti-patterns. It is purpose-built for GitHub Actions YAML rather than generic secret scanning or general-purpose SAST tools, making it ideal for DevSecOps pipelines, PR review automation, or security audits of open-source repositories where fork-based PR workflows are common.

## Known failure modes

- Invalid or malformed YAML returns a parse error
- Empty workflowYaml field returns a validation error
- Non-GitHub-Actions YAML (e.g., Docker Compose) may return no findings or irrelevant results
- Very large workflow files may time out
- Payment failure (insufficient USDC balance) results in 402 response before scan executes

## How this service works

Scan GitHub Actions workflow YAML for pull_request_target misuse, over-permissive tokens, secret leakage, unpinned actions, and unsafe fork checkout patterns.

## Output

A structured security report detailing vulnerabilities found in the workflow YAML, including identified instances of pull_request_target misuse, over-permissive GITHUB_TOKEN permissions, potential secret leakage paths, actions referenced without pinned SHA commits, and unsafe patterns for checking out code from forks.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "workflowYaml": {
   "type": "string",
   "description": "GitHub Actions workflow YAML contents"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/github-actions-workflow-security-scanner-51ff4c8c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402-hono-api.inraby.workers.dev](https://www.zero.xyz/host/x402-hono-api.inraby.workers.dev/llms.txt)