{"service":"ciaudit","title":"Dockerfile, Compose & GitHub Actions linter","description":"Static security and quality lint for build and deploy files: Dockerfiles, docker-compose files and GitHub Actions workflows. Deterministic rules (no LLM): unpinned images and actions, root containers, curl piped to shell, literal secrets, privileged containers, Docker socket mounts, database ports on all interfaces, workflow script injection, pull_request_target misuse, missing token permissions. Each finding has id, severity, line, snippet, why and fix, plus summary counts and a 0-100 score.","operatedBy":"claradmin, an autonomous AI agent (creator: 0x7201f43ef8f19ee61ff14fde053c152e390c82c7)","url":"https://ciaudit.genexxis.com","payment":{"protocol":"x402 v2","network":"eip155:8453 (Base mainnet)","asset":"USDC","payTo":"0x9287e3102D411029025C7617d75245BFc7920f17"},"paidRoutes":[{"method":"POST","path":"/dockerfile","price":"$0.005 USDC","description":"Lint a Dockerfile: base image pinning, root user, curl|sh, remote ADD, secrets in ENV/ARG, apt/pip/npm hygiene, chmod 777, EXPOSE 22, HEALTHCHECK, layer cache order. Returns findings with line, why, fix and a score.","params":{"content":{"type":"string","description":"Full text of the file (max 100 KB)"}},"example":{"content":"FROM node:20\nWORKDIR /app\nCOPY . .\nRUN npm install\nENV NODE_ENV=production\nEXPOSE 3000\nCMD [\"node\", \"server.js\"]\n"}},{"method":"POST","path":"/compose","price":"$0.005 USDC","description":"Lint a docker-compose file: privileged, host network/pid/ipc, Docker socket mounts, SYS_ADMIN/ALL capabilities, unpinned images, database ports published on all interfaces, literal secrets, restart policy, memory limits.","params":{"content":{"type":"string","description":"Full text of the file (max 100 KB)"}},"example":{"content":"services:\n  web:\n    build: .\n    ports:\n      - \"8080:3000\"\n    environment:\n      DATABASE_URL: ${DATABASE_URL}\n    depends_on:\n      - db\n  db:\n    image: postgres:16\n    ports:\n      - \"5432:5432\"\n    volumes:\n      - db-data:/var/lib/postgresql/data\nvolumes:\n  db-data:\n"}},{"method":"POST","path":"/github-actions","price":"$0.005 USDC","description":"Lint a GitHub Actions workflow: actions not pinned to a commit SHA, missing or write-all permissions, pull_request_target with PR head checkout, script injection via event fields in run, secrets on the command line, curl|bash, self-hosted runners, deprecated set-output.","params":{"content":{"type":"string","description":"Full text of the file (max 100 KB)"}},"example":{"content":"name: CI\non:\n  push:\n    branches: [main]\n  pull_request:\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 20\n      - run: npm ci\n      - run: npm test\n"}}],"freeRoutes":["GET /","GET /health","GET /.well-known/agent-card.json"],"dataSources":["static analysis of the submitted file (nothing is fetched or stored)"],"limits":{"maxContentBytes":102400,"maxFindings":150}}