# LineageLint GitHub Actions Workflow Risk Analyzer > LineageLint GitHub Actions Workflow Risk Analyzer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-16). Statically analyzes a GitHub Actions workflow for security risks including privilege escalation, untrusted checkouts, and GITHUB_TOKEN misuse, returning a scored verdict (BLOCK/WARN/PASS). ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/github-actions-workflow-risk - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-16 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/lineagelint-github-actions-workflow-risk-analyzer-760070ac - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__6mJ7vLC5vuoJjuhVsFcg Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability lineagelint-github-actions-workflow-risk-analyzer-760070ac ``` Example prompt: Run a security risk analysis on the privileged-pr-publisher GitHub Actions scenario and tell me if it should be blocked, what the risk score is, and what the most critical findings are. ## When to prefer this Use this endpoint when you need a fast, static security audit of a GitHub Actions workflow — specifically for risks like pull_request_target privilege escalation, write-all GITHUB_TOKEN permissions, unpinned actions, and untrusted checkouts — and want a machine-readable verdict with severity-graded findings. Prefer this over general SAST tools when the focus is GitHub Actions-specific workflow security posture rather than application code vulnerabilities. ## Known failure modes - Invalid or unsupported scenario enum value returns a 400 or validation error - Payment not included or insufficient USDC results in a 402 Payment Required response - Network timeout if the analysis backend is unavailable - Missing required 'input' body property returns schema validation error - Unsupported HTTP method returns 405 ## How this service works An autonomous paid API accepting USDC on Base mainnet. ## Output Returns a JSON object with a verdict (BLOCK/WARN/PASS), integer risk score (0-100), human-readable summary, per-job analysis including permission modes and untrusted checkout flags, a findings array with severity/code/remediation for each issue, approval gates, and a coverage report describing what checks were and were not performed. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "privileged-pr-publisher" ], "type": "string", "description": "Built-in paid GitHub Actions security-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "profile", "verdict", "risk_score", "summary", "stats", "events", "untrusted_event_classes", "jobs", "findings", "approval_gates", "coverage" ], "properties": { "jobs": { "type": "array", "items": { "type": "object" } }, "label": { "type": "string" }, "stats": { "type": "object" }, "events": { "type": "array", "items": { "type": "string" } }, "profile": { "enum": [ "public", "private" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "analysis_id": { "type": "string" }, "approval_gates": { "type": "array", "items": { "type": "string" } }, "analyzer_version": { "type": "string" }, "untrusted_event_classes": { "type": "array", "items": { "type": "string" } } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "jobs": [ { "index": 1, "job_id": "publish", "step_count": 3, "runner_class": "self-hosted-or-dynamic", "has_environment": false, "permission_mode": "write-all", "write_scope_count": 16, "untrusted_checkout": true, "action_reference_count": 2 } ], "label": "paid-demo:privileged-pr-publisher", "stats": { "job_count": 1, "line_count": 18, "step_count": 3, "shell_step_count": 1, "findings_by_severity": { "low": 0, "high": 5, "medium": 4, "critical": 4 }, "unpinned_action_count": 2, "action_reference_count": 2, "write_capable_job_count": 1 }, "events": [ "pull_request_target" ], "profile": "public", "summary": "BLOCK: 13 finding(s) across 1 job(s); 9 require resolution or explicit approval.", "verdict": "BLOCK", "coverage": { "mode": "static-github-actions-workflow-yaml", "checks": [ "GITHUB_TOKEN least privilege", "pull_request_target and workflow_run trust boundaries", "untrusted-context script injection", "action and reusable-workflow immutable pinning", "self-hosted runner exposure", "secret handling and delegation", "OIDC environment protection", "workflow artifact trust" ], "limitations": [ "Does not inspect referenced action source, repository settings, environment protection rules, or cloud OIDC trust policies.", "Cannot prove whether a commit SHA belongs to the expected upstream action repository.", "Static findings do not replace CodeQL workflow scanning, policy enforcement, or a review of every third-party action." ], "workflow_executed": false, "github_api_contacted": false, "repository_checked_out": false, "secret_values_returned": false }, "findings": [ { "code": "job_write_all_permissions", "path": "jobs.publish.permissions", "message": "The job grants write access to every supported GITHUB_TOKEN scope.", "severity": "critical", "standard": "github-actions-workflow-syntax", "remediation": "Grant only the exact scopes this job needs and separate untrusted processing from privileged work." }, { "code": "pull_request_target_untrusted_checkout", "path": "jobs.publish.steps[0].with.ref", "message": "A privileged pull_request_target job checks out attacker-controlled pull-request code.", "severity": "critical", "standard": "github-actions-untrusted-checkout", "remediation": "Do not … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lineagelint-github-actions-workflow-risk-analyzer-760070ac/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)