← Actions Artifact Poisoning Check
Actions Artifact Poisoning Check vs. zizmor
zizmor audits a GitHub Actions workflow against 41 checks, per its own documentation, but none of
them looks at what a workflow_run job does with a downloaded artifact. Its
dangerous-triggers audit flags workflow_run itself, by its mere presence, on every
job that uses it. Its artipacked audit checks the opposite direction of an artifact pipeline --
credentials leaking out through an upload, not a download's contents getting executed. This page checks the
specific behavior neither of those covers, free, on one pasted file, with nothing to install.
What each tool is for
zizmor (github.com/zizmorcore/zizmor) is an open-source, MIT-licensed static
analysis tool for GitHub Actions, installed with pip install zizmor or
cargo install zizmor and run against workflow files or a whole repository. Per its own
documentation it ships 41 audits covering unpinned or typosquatted uses: references, excessive
permission scopes, template injection, impostor commits, and more, and can emit SARIF for GitHub code
scanning. Two of its audits sit near this page's territory without covering it:
dangerous-triggers flags pull_request_target and workflow_run as
fundamentally hard to use safely, by the trigger's presence alone; artipacked flags
actions/checkout persisting a credential that a later upload-artifact step might
publish. Neither inspects what a workflow_run job does with something it downloads.
This checker does exactly that and nothing else: paste the YAML of a workflow file, and it
finds every workflow_run job that downloads an artifact
(actions/download-artifact or dawidd6/action-download-artifact) and later runs
something that looks like it executes a file from disk, plus every download-artifact step with
no name: input. It runs entirely in your browser, needs no install and no token, and makes no network call of its own under any configuration.
| Question | Where to answer it |
|---|---|
| I want one maintained scanner covering a broad catalogue of GitHub Actions security patterns. | zizmor -- 41 audits is its entire job, and this tool checks one narrow pattern none of them covers. |
My workflow already trips zizmor's dangerous-triggers finding on a workflow_run job -- is this specific job the dangerous one? | This checker -- it reads what the job actually does with a download, rather than flagging the trigger's presence alone. |
| I want to know if a credential could leak out through an artifact my workflow uploads. | zizmor's artipacked audit -- that is the upload side of the pipeline, which this tool does not check. |
I want to know if a downloaded artifact could get executed, or is pulled in unscoped, in a privileged workflow_run job. | This checker -- paste the YAML, get the two-row answer, no CLI and no repository access. |
| I want SARIF output wired into GitHub code scanning, or a report across an entire repository of workflows. | zizmor -- its CLI and GitHub Action are built for exactly that. |
The two are complementary, not competing: a repository can run zizmor in CI for its full catalogue and still reach for this page the moment the question is specifically "does this workflow_run job download and execute an artifact" -- a question zizmor's own audit list, read closely, does not currently answer.
Common questions
Should I use this checker or zizmor?
Both, for different questions. zizmor is an open-source, MIT-licensed static analysis CLI (installed with pip install zizmor or cargo install zizmor) that audits a GitHub Actions workflow, or a whole repository of them, against 41 checks per its own documentation -- unpinned actions, excessive permissions, credential leakage, impostor commits, template injection, and more, with SARIF output for GitHub code scanning. None of those 41 is the specific pattern this page checks: a workflow_run job that downloads an artifact and later executes something from it, or a download-artifact step with no name: pin. If you want one maintained tool covering a broad catalogue of GitHub Actions security patterns, run zizmor. If you want to know whether the one workflow_run job in front of you actually does something dangerous with a downloaded artifact, this page answers that specifically, with nothing to install.
Does zizmor already catch what this tool catches?
Not the same finding. zizmor's dangerous-triggers audit flags workflow_run by its mere presence in a workflow -- per its own documentation it is one of the trigger types the audit treats as fundamentally dangerous, and it fires on every workflow that uses the trigger at all, regardless of what the job actually does. zizmor's artipacked audit checks the opposite direction of an artifact pipeline: a credential persisted by actions/checkout leaking out through an uploaded artifact, not a downloaded artifact's contents being executed. Neither audit inspects what a workflow_run job does with something it downloads. This page fills that specific gap: it flags only a downloaded artifact getting executed later in the same job, or a download-artifact step with no name: input, and says nothing about a workflow_run job that does neither.
Why check something zizmor's broader trigger audit already flags?
Because zizmor's signal there is coarse on purpose: dangerous-triggers exists to warn that pull_request_target and workflow_run are hard to use safely at all, not to say which specific job behavior makes one unsafe. A workflow_run job that never touches an artifact, and one that downloads and executes a fork-controlled artifact, both trip the same zizmor finding with the same severity. This page reads what the job actually does with a download and reports only the two behaviors that make it dangerous, so a maintainer already carrying a dangerous-triggers finding can tell whether this specific job is the one that needs fixing first.
Does this tool need a GitHub token or repository access the way some zizmor audits do?
No, never. zizmor documents an optional online mode -- enabled by setting GH_TOKEN, GITHUB_TOKEN or ZIZMOR_GITHUB_TOKEN -- that some of its audits use for checks needing GitHub API access, such as confirming a pinned commit is genuinely reachable from the repository. This page has no online mode to opt into and no repository access at all: you paste the YAML, and the scan runs entirely in this browser tab with no network call of its own under any configuration.
Is this page affiliated with zizmor or its maintainers?
No. This site is not affiliated with, endorsed by, or sponsored by zizmor, zizmorcore, or its maintainers. zizmor is an independent open-source project, named here only to describe what this checker is and is not, using facts drawn from its own public documentation and source repository at github.com/zizmorcore/zizmor.