Show HN: ActionsGuardHub – A tool for analyzing Malicious GitHub Actions (github.com)

ActionsGuardHub is an open-source, modular scanner that uses AI to analyze GitHub Actions for malicious behavior and vulnerabilities. Written for Python 3.8+, it integrates with LangChain to support multiple model providers (Google Gemini by default — gemini-2.5-flash/pro — and OpenAI options like gpt-4o-mini), requires a Google API key (OpenAI optional) and optional GitHub auth (PAT or GitHub App). The CLI can scan single actions, lists, whole repositories or organizations, and can run AI-powered analysis or metadata-only collection. Each run produces detailed reports across 10+ security categories, actionable remediation suggestions, JSON/text exports, and an interactive web dashboard for filtering and visualization. For the AI/ML and security community, ActionsGuardHub provides a scalable way to triage third‑party actions, perform bulk screening, and augment manual audits with AI-driven heuristics. Key technical implications: LangChain handles model selection and provider abstraction, Gemini/OpenAI models power the behavioral and vulnerability reasoning, and outputs are intended for human review rather than automated enforcement. The repo includes installation and env setup, example CLI flags (e.g., --input-type actions/repositories/organization, --ai-model, --skip-ai-scan) and warns about AI false positives/negatives — the tool is designed to supplement, not replace, expert security review or compliance processes.