Actions Injection Check vs. zizmor
Two overlapping findings, very different packaging. zizmor is an installable, open-source CLI that audits a workflow against a broad catalogue of GitHub Actions security patterns -- including the two this page checks. This tool answers only the injection question, on one file you paste, free, with nothing to install and no network call of its own.
What each tool is for
zizmor (github.com/zizmorcore/zizmor) is an open-source, MIT-licensed static
analysis tool for GitHub Actions, installed with pip install zizmor or
cargo install zizmor and run against workflow files or a whole repository. Per its own
documentation, its audits cover template injection (attacker-controlled code execution via an untrusted
${{ ... }} expression spliced into a shell command), dangerous triggers
(pull_request_target and workflow_run -- the pwn-request shape), excessive
permission scopes, credential persistence and leakage, cache poisoning, and impostor or confusable commit
references, among others. It can emit plain-text, JSON, or SARIF output, the last of which integrates with
GitHub's code-scanning feature, and it runs offline by default; an optional online mode (set
GH_TOKEN, GITHUB_TOKEN, or ZIZMOR_GITHUB_TOKEN) enables audits that
benefit from GitHub API access.
This checker does two of those things and nothing else: you paste the YAML of a workflow
file, and it lists every pull_request_target/workflow_run checkout of an
untrusted head and every run: step that interpolates an untrusted
${{ github.event.* }} expression, each with the exact fix. It runs entirely in your browser,
needs no install and no token, and makes no network call of its own under any configuration.
| Question | Where to answer it |
|---|---|
| I want one maintained scanner covering dozens of GitHub Actions security patterns -- permissions, credential leakage, cache poisoning, impostor commits, injection, and more. | zizmor -- that breadth is its entire job, and this tool checks only two of those patterns. |
| I just want to know if the one workflow file in front of me has a pwn-request checkout or a shell-injection line, right now, with nothing to install. | This checker -- paste the YAML, get the two-row answer, no CLI and no repository access. |
| I want SARIF output wired into GitHub code scanning, or a report across an entire repository of workflows. | zizmor -- its CLI and GitHub Action are built for exactly that. |
| I want this specific check to fail my CI automatically. | Either: zizmor's own GitHub Action, or this tool's check.py --fail-on-risk for the injection question specifically. |
| I don't want to install a CLI (pip or cargo) or add a new GitHub Action just to check one file. | This checker -- it is a page, not a package. |
The two are complementary, not competing: a repository can run zizmor in CI for the full catalogue of checks and still reach for this tool the moment the question is "does this one pasted file have a pwn-request or injection problem" without installing anything.
Common questions
Should I use this checker or zizmor?
They overlap on exactly two findings and differ everywhere else. zizmor is an open-source, MIT-licensed static analysis CLI (installed with pip install zizmor or cargo install zizmor) that audits a GitHub Actions workflow -- or a whole repository of them -- against a broad, growing catalogue of checks: template injection, dangerous triggers such as pull_request_target and workflow_run, excessive permission scopes, credential leakage, cache poisoning, and impostor or confusable commit references, among others, per its own documentation. This tool checks two of those findings only -- the pwn-request checkout and the shell script-injection pattern -- and runs entirely in your browser on YAML you paste, with nothing to install and no repository access. If you want one maintained tool covering dozens of GitHub Actions security patterns with CI-ready output, zizmor is the right tool. If you want a fast, no-install answer to the injection question on one file in front of you right now, this is the narrower tool for that.
Does zizmor already catch what this tool catches?
For these two patterns specifically, yes -- zizmor's own documentation names a template-injection audit for untrusted expressions spliced into a run: step and a dangerous-triggers audit for pull_request_target and workflow_run, which is the same pwn-request and script-injection ground this tool covers. The difference is packaging, not detection power: zizmor runs both audits (and the rest of its catalogue) as part of one CLI invocation you install and point at files or a repository, and can emit SARIF for GitHub code scanning; this tool runs only those two checks, in a page you open with nothing to install, for the moment you want one quick answer rather than a full scan.
Why use a narrower tool if zizmor already covers more ground?
Two reasons this tool exists alongside it. First, zizmor is a CLI you install with pip or cargo and then run against files on disk; this tool is a page you open and paste into, which is faster when the workflow is not yet checked out anywhere, or you just want to check the one file in front of you. Second, a broad multi-category scan report is a different shape of answer than a two-row table naming exactly which line is a pwn-request checkout or a script-injection sink and what to change -- when the question is only the injection one, this tool's narrower output is faster to read.
Does this tool need a GitHub token the way zizmor sometimes does?
No, never. zizmor documents an optional online mode -- enabled by setting GH_TOKEN, GITHUB_TOKEN or ZIZMOR_GITHUB_TOKEN -- for audits that benefit from GitHub API access, and runs offline by default when none of those are set, which already covers the two checks this tool performs. This tool has no online mode to opt into: it makes no network call of its own under any configuration, because nothing here talks to a server at all.
Is this page affiliated with zizmor or its maintainers?
No. This site is not affiliated with, endorsed by, or sponsored by zizmor, zizmorcore, or its maintainers. zizmor is an independent open-source project, named here only to describe what this checker is and is not, using facts drawn from its own public documentation, source repository at github.com/zizmorcore/zizmor, and package listing at pypi.org/project/zizmor.