ci-security

Static auditor for randomness and nonce hygiene in Python source - flags weak PRNGs, hardcoded keys, reused counters, static IVs, short salts. CWE-330 mapped, CI-gating exit codes. Python 3.11, stdlib only.

A CLI tool for managing GitHub Actions workflows

Free open-source wrapper of pip to avoid supply-chain attacks

CI security scanner for AI agents. Detects prompt injection risks, unsafe tool permissions, and generates OpenPAKT reports.

Cut vuln noise to near-zero by proving which CVEs are actually callable from your app’s entry points, using open CLIs, reproducible SBOMs, and CI-first workflows.

Local-only GitHub Actions and CI maintenance check for AI-built apps.

Distribution packages and deployment artifacts for Chainguard's Octo STS token service

OpenPAKT: Open Protocol for Agent Knowledge Trust — a language-agnostic specification for AI agent security findings, scenarios, and CI policy gating.

Find CI agents that eat untrusted GitHub events and hold secrets. Static recon for the clinejection class (untrusted issue -> AI agent step -> npm token -> publish), a harmless canary 'prove' mode, and a local agent-config audit.

Analyses and pins GitHub actions in your workflows

Static analysis for AI automation workflows. Find prompt-injection paths, overpowered tools, and write-capable agent jobs before they run.

skillsig

Flags known patterns of weakened tests and CI checks in a Git diff.

A lightweight .NET CLI that scans GitHub Actions workflows for security, reliability, performance, and cost issues.

Scan AI agent prompts and workflows for security risks in CI and generate OpenPAKT-compliant reports

Pre-delivery truth infrastructure

Read-only GitHub Actions security linter for unsafe triggers, permissions, secrets, checkouts, runners, and unpinned actions.

Scan CI/CD workflows for unsafe AI coding-agent usage.

Behavioral multi-turn prompt injection detection for LLM applications. Built for CI workflows.

Finds secrets in Git with Gitleaks + scripts. Outputs concise JSON reports (commit ID, author). Can push updates to Confluence and notify via Slack.