Claude Skill

Audit GitHub Actions for privilege and supply-chain risks with zizmor

Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early.

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download agentskillexchange-skills-skills_audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor-07beb56.zip · 0 KB

agentskillexchange/skills 45 57 forks MIT Updated 12h ago

Part of agentskillexchange/skills — 249 skills

Install

skills CLI

npx skills add https://github.com/agentskillexchange/skills/tree/main/skills/audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install agentskillexchange-skills@llmmart

Git git clone https://github.com/agentskillexchange/skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole agentskillexchange/skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Audit GitHub Actions for privilege and supply-chain risks with zizmor

Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early.

Prerequisites

Python 3.9+ or prebuilt zizmor binary, access to the target repository

Installation

Basic usage or getting-started notes:

detailed usage recipes.
Source: https://github.com/zizmorcore/zizmor
Extracted from upstream docs: https://raw.githubusercontent.com/zizmorcore/zizmor/HEAD/README.md

Documentation

https://woodruffw.github.io/zizmor/

Source

Agent Skill Exchange

Files (skills)

SKILL.md 1.4 KB

---
name: "Audit GitHub Actions for privilege and supply-chain risks with zizmor"
slug: "audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor"
description: "Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early."
github_stars: 4186
verification: "security_reviewed"
source: "https://github.com/zizmorcore/zizmor"
author: "zizmorcore"
publisher_type: "organization"
category: "Security & Verification"
framework: "Multi-Framework"
tool_ecosystem:
  github_repo: "zizmorcore/zizmor"
  github_stars: 4186
---

# Audit GitHub Actions for privilege and supply-chain risks with zizmor

Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early.

## Prerequisites

Python 3.9+ or prebuilt zizmor binary, access to the target repository

## Installation

Basic usage or getting-started notes:
- [detailed usage recipes].
- [detailed usage recipes]: https://docs.zizmor.sh/usage/

- Source: https://github.com/zizmorcore/zizmor
- Extracted from upstream docs: https://raw.githubusercontent.com/zizmorcore/zizmor/HEAD/README.md

## Documentation

- https://woodruffw.github.io/zizmor/

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor/)