GitHub Actions Security Checker (Free)

An offline checker for .github/workflows/*.yml that finds the mistakes behind most GitHub Actions breaches: script injection from issue and PR titles, pull_request_target "pwn requests", actions pinned to movable tags, over-broad GITHUB_TOKEN permissions, plain-text secrets, curl | bash, and self-hosted runners exposed to forks. Every finding comes with the line number and a concrete fix.

• Python 3.9+, standard library only (it ships its own small YAML reader). No account, no network, nothing uploaded.
• Output: readable text, JSON, GitHub annotations (--format github) or SARIF for code scanning (--format sarif).
• Exit code 1 when there are errors, so it can fail CI. --fail-on warning makes it stricter.
• Includes a Claude Code skill (skills/github-actions-security) so Claude runs the check and fixes the workflow for you.

python3 -m ghasec                      # checks ./.github/workflows
python3 -m ghasec path/to/repo --min-level warning
python3 -m ghasec .github/workflows/release.yml --format json

Run ./demo.sh to see it on the example workflows and ./run_tests.sh for the 15 tests.

- run: python3 -m ghasec --format github --min-level warning

Copy the ghasec/ folder into your repo (or a tools repo) first. Ignore a rule with --ignore GHA005,GHA012.

• It reads workflow files; it doesn't see repository settings (default token permissions, fork approval rules) or the code inside the actions you call.
• Pattern-based: it can miss injection that goes through intermediate outputs, and it can flag a value you've already validated. Read each finding.
• The YAML reader covers what workflows use; anchors and aliases are reported as parse errors.
• Not affiliated with GitHub.