workflow-security

A multi-platform CI/CD vulnerability detection and attack automation tool for identifying security weaknesses in pipeline configurations.

GitHub Actions security scanner: pin actions to SHAs, detect script injection, audit permissions. Fix supply chain vulnerabilities.

Safety and contract checks for AI-generated n8n workflows

CSINT Research side project for static and staging-safe security regression checks of n8n AI workflows.

💻 Workflow Data For Github Actions & Linux Server Testing of Lockdown Enterprise Content 💻

Offensive GitHub Actions attack surface analyzer : scan any repo for CI/CD vulnerabilities, pwn requests, supply chain risks, and secret leaks. Powered by 20 detection rules with CVSS scoring and OWASP CI/CD Top 10 mapping.

💻 Workflow Data For Github Actions & Windows Server Testing of Lockdown Enterprise Content 💻

Harden and manage your GitHub Actions: SHA-pin every action, enforce allowlist policies, update interactively, and analyze run health

Moved to the actions plugin in austenstone/.copilot.

Hands‑on examples of extending KICS to detect GitHub Actions exploitation techniques.

This action scans your repository's workflows for uses: references, checks the GitHub API for each action's latest release, and reports version drift or insecure tag pinning (e.g., pinning to v1 instead of a commit SHA).

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

Diff GitHub Actions trust boundaries before merge—token permissions, triggers, Secret references, third-party Actions, and risky scripts. Local CLI; no GitHub token required.

Local web app and CLI that maps GitHub Actions workflow blast radius from real YAML: triggers, permissions, actions, secrets, and fixes

A lightweight .NET CLI that scans GitHub Actions workflows for security, reliability, performance, and cost issues.

AI Admissibility Action: external controlled negotiation protocol (CNP) for automated and AI-driven actions. This gate decides whether execution may continue.

Read-only GitHub Actions security linter for unsafe triggers, permissions, secrets, checkouts, runners, and unpinned actions.

AEAP Composition Boundary Adapter for the Microsoft Agent Framework (Python). Thin wrapper that attaches the AEAP Runtime Decision Point to agent middleware and workflow execution. Published as aiyoplane-microsoft-agent-framework on PyPI.

AEAP Composition Boundary Adapter for CrewAI. Thin wrapper that attaches the AEAP Runtime Decision Point to CrewAI tool invocations by any crew member. Published as aiyoplane-crewai on PyPI.