Audit Github Actions For Privilege And Supply Chain Risks With Zizmor

Name: Audit Github Actions For Privilege And Supply Chain Risks With Zizmor
Author: agentskillexchange

ASecurity

Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early.

36 stars
0 votes
0 copies
1 view
Added June 8, 2026

ai-agentspythongogitsecuritydocumentation

Security analysis

A100/100

Scanned June 8, 2026

npx -y skills add agentskillexchange/skills --skill audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Audit Github Actions For Privilege And Supply Chain Risks With Zizmor?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Audit Github Actions For Privilege And Supply Chain Risks With Zizmor

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/agentskillexchange-audit-github-actions-for-privilege-and-supply-chai/badge)](https://www.skillsdirectory.com/skills/agentskillexchange-audit-github-actions-for-privilege-and-supply-chai)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: "Audit GitHub Actions for privilege and supply-chain risks with zizmor"
slug: "audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor"
description: "Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early."
github_stars: 4186
verification: "security_reviewed"
source: "https://github.com/zizmorcore/zizmor"
author: "zizmorcore"
publisher_type: "organization"
category: "Security & Verification"
framework: "Multi-Framework"
tool_ecosystem:
  github_repo: "zizmorcore/zizmor"
  github_stars: 4186
---

# Audit GitHub Actions for privilege and supply-chain risks with zizmor

Run a focused security pass on GitHub Actions workflows before merge so token misuse, dangerous permissions, and unpinned actions are caught early.

## Prerequisites

Python 3.9+ or prebuilt zizmor binary, access to the target repository

## Installation

Basic usage or getting-started notes:
- [detailed usage recipes].
- [detailed usage recipes]: https://docs.zizmor.sh/usage/

- Source: https://github.com/zizmorcore/zizmor
- Extracted from upstream docs: https://raw.githubusercontent.com/zizmorcore/zizmor/HEAD/README.md

## Documentation

- https://woodruffw.github.io/zizmor/

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/audit-github-actions-for-privilege-and-supply-chain-risks-with-zizmor/)