feat: add @sh1pt/agent-vu1nz — CI/CD security scanner plugin

[Preshy]

Summary

Adds a new agent package wrapping the vu1nz-gh-actions CLI tool — an open-source GitHub Actions security scanner that detects CI/CD workflow vulnerabilities.

Part of the vu1nz security ecosystem.

Features

• 17 security checks for GitHub Actions workflows:
  • 🔴 Script injection (critical)
  • 🔴 pull_request_target + checkout PR HEAD (critical)
  • 🔴 Secrets in run commands (critical)
  • 🟠 Unpinned actions, matrix injection, PR target usage, and more
  • 🟡 Write-all permissions, unpinned Docker, deploy-on-push
• Optional Claude AI review of security findings
• Token via env var (never CLI args — avoids process listing leaks)
• GITHUB_TOKEN from sh1pt vault used automatically

Usage

In your sh1pt.config.ts:

targets: {
  "scan-actions": {
    use: "agent-vu1nz",
    config: {
      repo: "owner/repo",
      failOn: "high",
    },
  },
}

Or with Claude AI review:

config: {
  repo: "owner/repo",
  claude: true,
  claudeModel: "claude-sonnet-4-20250514",
}

Implementation

Follows the exact defineAgent<Config> pattern from the existing Claude/Codex/Qwen agents:

• check() — verifies vu1nz CLI is installed
• run() — executes vu1nz actions scan with opts forwarded
• ensureCli() — gives helpful install instructions if missing
• Secrets passed via exec env (not CLI) for security
• Contract test included

[github-actions]

vu1nz CI/CD Security Scan

Scan completed.