zizmor

Scan GitHub Actions workflows for security issues and output scrutineer findings JSON.

Updated May 20, 2026

Search Tags:#security #audit #github-actions #workflows #findings #zizmor #scrutineer

Ready to run

npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill zizmor-lukehinds

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: zizmor
Source: https://github.com/lukehinds/scrutineer-attest-test/tree/main/skills/zizmor
Command: npx skills add https://github.com/lukehinds/scrutineer-attest-test --skill zizmor-lukehinds

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Audit the repository's GitHub Actions workflows for credential mishandling, untrusted inputs, template injection, and overly permissive tokens, and convert findings to scrutineer's shape to streamline security reviews.

Core Features & Use Cases

Scan GitHub Actions workflows in any repository with a .github/workflows directory to detect common security issues.
Map identified issues into scrutineer's findings schema for integration with dashboards and alerts.
Use in CI or manual reviews to surface actionable security signals from workflow configurations.

Quick Start

Run the provided script to scan workflows and emit findings to report.json.

Frequently Asked Questions about zizmor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit GitHub Actions workflows for security issues like template injection?▼

To audit GitHub Actions workflows for security issues, you can scan any repository with a .github/workflows directory to detect credential mishandling, untrusted inputs, template injection, and overly permissive tokens. Results are output as a JSON findings structure.

What security vulnerabilities are commonly found in GitHub Actions workflows?▼

Common security vulnerabilities in GitHub Actions workflows include credential mishandling, untrusted inputs, template injection, and overly permissive tokens. Scanning workflow files identifies these configuration risks and converts them into actionable findings.

Can I integrate GitHub Actions security findings into dashboards or alerts?▼

Yes, you can integrate GitHub Actions security findings into dashboards or alerts by mapping identified issues into scrutineer's findings schema. This JSON format streamlines security reviews and enables downstream monitoring.

Do I need Python to run a GitHub Actions workflow security scan?▼

Yes, you need Python 3 on PATH to run a GitHub Actions workflow security scan. The scanning process also requires the zizmor tool available to analyze workflow files and emit findings to a report.json file.

Can I use this GitHub Actions security audit in CI pipelines?▼

Yes, you can use this GitHub Actions security audit in CI pipelines or manual reviews. Running the provided script surfaces actionable security signals from workflow configurations directly within your automated pipeline.

What is the best way to detect overly permissive tokens in GitHub Actions?▼

The best way to detect overly permissive tokens in GitHub Actions is to run an automated scan of your workflow files. The scan evaluates token configurations and translates identified permission risks into a structured JSON findings format.