Workflow Security Audit

Check a GitHub Actions workflow for potential supply-chain risks. Returns findings, severity counts and a risk level.

workflow-security-audit

Example

Example answer

{
  "summary": {
    "low": 0,
    "high": 0,
    "info": 0,
    "medium": 1,
    "critical": 0
  },
  "findings": [
    {
      "category": "permissions_scope",
      "location": "workflow",
      "severity": "medium",
      "description": "No explicit permissions declared. Workflow inherits default repository permissions, which may be overly broad.",
      "recommendation": "Add explicit 'permissions' block with minimum required scopes."
    }
  ],
  "risk_level": "medium",
  "findings_count": 1,
  "checks_performed": [
    "action_pinning",
    "permissions_scope",
    "secret_exposure",
    "trusted_publishers",
    "dangerous_triggers",
    "runner_security"
  ]
}

Inputs

Field	Type	Required	What it is
`workflow`	string	Yes	GitHub Actions workflow YAML content

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`summary`	object	Always (present in every successful answer)
`findings`	array	Always (present in every successful answer)
`risk_level`	string	Always (present in every successful answer)
`findings_count`	number	Always (present in every successful answer)
`checks_performed`	array	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "workflow-security-audit",
    "inputs": {
      "workflow": "name: test\non: [push]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hello\n"
    },
    "max_price_cents": 3
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "workflow-security-audit",
    "inputs": {
      "workflow": "name: test\non: [push]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hello\n"
    },
    "max_price_cents": 3
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "workflow-security-audit",
  inputs: {
    "workflow": "name: test\non: [push]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hello\n"
  },
  max_price_cents: 3,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="workflow-security-audit",
    inputs={
        "workflow": "name: test\non: [push]\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo hello\n",
    },
    max_price_cents=3,
))

Limitations

GitHub Actions only
Only supports GitHub Actions workflow YAML. Does not audit GitLab CI, CircleCI, or other CI systems.
Static analysis only
Checks YAML structure and patterns. Cannot verify whether a pinned SHA actually corresponds to a trusted release.

Bundled checks that include it

Pre-Merge Check €0.32