matheusht/RedThread Security Scan
Run a RedThread LLM security campaign in GitHub Actions and publish evidence.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 24, 2026
- License
- MIT
Pinned Snippet
uses: matheusht/redthread@4e5fd45d8ae0fd79c161f95e55fb8c7a7d637a6f # v0.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| objective | Security objective to test. | yes | — |
| system-prompt | Target agent system prompt to test. | yes | — |
| rubric | RedThread judge rubric basename. | no | authorization_bypass |
| algorithm | Attack algorithm: pair, tap, crescendo, or mcts. | no | tap |
| personas | Number of adversarial personas to generate. | no | 2 |
| dry-run | Run sealed/offline campaign without live target calls. | no | true |
| target | Optional target model override. | no | "" |
| python-version | Python version for RedThread. | no | 3.12 |
| working-directory | Directory containing the RedThread checkout. | no | . |
| report-dir | Directory where RedThread report artifacts are written. | no | redthread-report |
| comment-pr | Post the Markdown report as a pull request comment when possible. | no | false |
| github-token | GitHub token used for optional PR comments. Falls back to github.token. | no | "" |
Outputs
| name | description |
|---|---|
| report-markdown | Path to the Markdown report. |
| report-json | Path to the JSON report. |