zizmorcore/zizmor ? reverse-engineered prompt

Build me a command line security scanner for CI and CD workflows, focused on GitHub Actions first. I want it to check workflow files and related config for common mistakes like unsafe template usage, leaked or persistent credentials, overly broad permissions, suspicious commits or git refs, and other risky patterns you’d expect in automation pipelines.

It should be something I can run on a repo and get clear, readable findings, with enough detail to understand what is wrong and how to fix it. If possible, include a way to auto fix the safer issues, plus a simple quickstart and documentation for using it in local projects and in CI. Please make it feel polished and production ready, with tests and a clean CLI experience.

If you need to look up current docs or best practices online, go ahead and do that.