workflow-security

A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.

GitHub Actions security scanner: pin actions to SHAs, detect script injection, audit permissions. Fix supply chain vulnerabilities.

Safety and contract checks for AI-generated n8n workflows

💻 Workflow Data For Github Actions & Linux Server Testing of Lockdown Enterprise Content 💻

Offensive GitHub Actions attack surface analyzer : scan any repo for CI/CD vulnerabilities, pwn requests, supply chain risks, and secret leaks. Powered by 20 detection rules with CVSS scoring and OWASP CI/CD Top 10 mapping.

CSINT Research side project for static and staging-safe security regression checks of n8n AI workflows.

Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health

Tool-verified GitHub Actions agent skills: optimize, secure, and re-architect workflows with actionlint + zizmor instead of guesswork.

💻 Workflow Data For Github Actions & Windows Server Testing of Lockdown Enterprise Content 💻

This action scans your repository's workflows for uses: references, checks the GitHub API for each action's latest release, and reports version drift or insecure tag pinning (e.g., pinning to v1 instead of a commit SHA).

Hands‑on examples of extending KICS to detect GitHub Actions exploitation techniques.

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

One GitHub Action that runs zizmor, skillxray, a fork-PR checkout check, and a secrets scan as a single pass or fail gate.

Diff GitHub Actions trust boundaries before merge—token permissions, triggers, Secret references, third-party Actions, and risky scripts. Local CLI; no GitHub token required.

Local web app and CLI that maps GitHub Actions workflow blast radius from real YAML: triggers, permissions, actions, secrets, and fixes

A lightweight .NET CLI that scans GitHub Actions workflows for security, reliability, performance, and cost issues.

AI Admissibility Action: external controlled negotiation protocol (CNP) for automated and AI-driven actions. This gate decides whether execution may continue.

MCP server that statically scans n8n automation workflows for security issues (SAST for n8n): SSRF/IMDS, code injection, unauth webhooks, hardcoded secrets, PII egress. Includes STRIDE threat model.

External admission gate for GitHub Actions.