Audit your CI dependencies locally.

Wisesama CI audit

Version 0.1.2 · Node.js 20 or later · MIT license. The download includes the agent instructions, standalone checker, source, and license notices.

No Wisesama account, API key, or paid plan is required.

Run a local check

Extract the download into a tools directory outside the project you want to review. Read its SKILL.md before giving it to your coding agent.

tar -xzf wisesama-ci-audit-0.1.2.tar.gz

Point the checker at your project. It reads local configuration and prints a JSON report without running project code or fetching dependencies.

node ./wisesama-ci-audit/scripts/ci-audit.mjs --root /absolute/path/to/project

Or ask your coding agent to use the extracted skill:

Use the wisesama-ci-audit skill in /absolute/path/to/wisesama-ci-audit to review CI dependency references in /absolute/path/to/project. Explain the evidence and unresolved coverage.

Add --output /absolute/path/to/new-report.json to save a report. The checker creates a new file and refuses to overwrite an existing file.

Keep each conclusion attached to its evidence

The report identifies the dependency, reference, file and line, local-file fingerprint, and a suggested next step. Its states describe configuration:

• Pinned: a full commit or image digest was observed.
• Locked: matching workflow-lock configuration was observed.
• Mutable: a tag or branch can resolve to different code.
• Local: the reference points within the repository.
• Unknown: the available files do not establish a conclusion.

Review the suggested change through your normal code review process, then run the check again. Preserve unresolved dependencies and any changed file fingerprints.

Understand the scope

This is a bounded configuration check. It does not establish that dependency code is safe, that a workflow ran, or that a deployment was affected. External actions, reusable workflows, remote includes and runtime downloads are not fetched or executed. Unsupported, unreadable and omitted files remain explicit coverage limits.

The checker works offline and has no source upload or telemetry. Sharing a report through your coding agent follows that agent’s own data settings. Review the report before sharing it with anyone else.

For broader source-code auditing, see Cloudflare’s security-audit skill, which defines a separate process for coverage, independent verification and findings.