{"uid":"cap_22JRmYGOTnQDFJRVcFBQg","slug":"cicd-scan-8052d301","name":"cicd-scan","description":"Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.","url":"https://payai.agentstools.dev/ci/scan?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"format":{"enum":["auto","github-actions","gitlab-ci","circleci"],"type":"string","description":"CI system, or auto to detect from the content"},"content":{"type":"string","description":"The CI/CD config text to scan (workflow file)"}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_LPowYZwcxJpwNXI1TXNHs","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically scans a CI/CD pipeline configuration file (GitHub Actions, GitLab CI, or CircleCI) for security vulnerabilities and misconfigurations, returning a verdict, risk score, and per-finding details with fix hints.","exampleAgentPrompt":"Can you scan this GitHub Actions workflow file for security issues and tell me whether it passes, needs caution, or should be blocked, along with a risk score and any specific fixes I should make?","exampleUseCases":[{"title":"Pre-merge pipeline security gate","prompt":"Before I merge this PR, scan the GitHub Actions workflow YAML I'm pasting — I need to know if it passes, gets a caution, or should be blocked, and exactly what lines to fix: [workflow YAML here]"},{"title":"Audit legacy GitLab CI config","prompt":"I have an old GitLab CI config that's been around for years — can you run a security scan on it using auto-detect format and tell me the risk score plus every vulnerability with how to fix each one?"},{"title":"CircleCI orb pinning check","prompt":"Check this CircleCI config for unpinned orbs and any other security problems — give me the verdict and a concrete list of what needs to change before we deploy."}],"resultDescription":"Returns a verdict string (pass, caution, or block), a 0–100 integer risk score, and an array of per-finding objects each containing: the rule ID triggered, severity level, the affected object/step, its location in the file, and a concrete fix hint. Multiple findings can be returned for a single scan.","failureModes":["Unrecognized or malformed YAML/config content returns a parsing error","Content too large may be rejected or truncated","Auto-detection may misidentify the CI format if the file is ambiguous — use explicit format enum to avoid this","False negatives are possible; results are security indicators, not guarantees","Empty or missing content field returns a validation error"],"whenToPreferThis":"Choose this endpoint when you need a fast, structured, per-rule security analysis of a CI/CD config file specifically for GitHub Actions, GitLab CI, or CircleCI — especially when you need actionable fix hints and a machine-readable verdict (pass/caution/block) suitable for automated pipeline gating. Prefer this over generic SAST tools when your primary concern is supply-chain risks like unpinned actions, secret leakage, permission sprawl, and injection in CI workflows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-12T18:44:41.755Z","isFirstParty":false,"canonicalSlug":"cicd-scan-8052d301"}