{"slug":"api-agentstools-dev-ci-scan-7f4cf9","title":"Static security scan of a CI/CD pipeline config","host":"api.agentstools.dev","method":"POST","resource":"https://api.agentstools.dev/ci/scan","category":"image","description":"Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, ","price_listed":0.02,"price_asked":null,"state":"effects","state_label":"Not tested: has real-world effects","checks_7d":0,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":4,"reported_payers_30d":2,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"content":"name: ci\non: pull_request_target\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@v4\n      with:\n        ref: ${{ github.event.pull_request.head.ref }}\n    - run: echo \"${{ github.event.issue.title }}\"\n","format":"github-actions"},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"properties":{"content":{"description":"The CI/CD config text to scan (workflow file)","type":"string"},"format":{"description":"CI system, or auto to detect from the content","enum":["auto","github-actions","gitlab-ci","circleci"],"type":"string"}},"required":["content"]},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST","PUT","PATCH"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[],"description_full":"Static security scan of a CI/CD pipeline config: GitHub Actions, GitLab CI or CircleCI. Detects unpinned actions / images / orbs, template and environment injection, dangerous triggers, over-broad workflow-token permissions, secrets leaked to logs, cache poisoning and more. Returns a verdict (pass, caution, block), a 0-100 risk score and per-finding rule, severity, object, location and a concrete fix hint. Security indicators, not a guarantee.","last_updated":"2026-09-08T23:29:38.3Z","schemes":["exact"]}