{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/secret-blast-radius@0.3.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Answers one question about your CI, and it is not whether an outsider can get in: given the secrets a workflow already declares, how far does each one actually reach inside your own run? Where ci-supply-chain asks whether an outside contributor can reach your secrets and workflow-injection asks whether untrusted text can become a command, this reads the reach of a secret you deliberately gave your own CI, because a CI secret is scoped by whoever wrote the YAML and the usual scope is everything. For every secret name a workflow mentions it reports the real reach - which jobs, how many steps, and which third-party actions can read it - and that per-secret reach table, not a list of rule hits, is the output. Ranked by reach rather than by rule: a secret sitting in the environment of a step that runs npm install, pip install, go mod download or npx is CRITICAL, because every postinstall and build backend in the tree is arbitrary code from hundreds of authors and it runs with that environment; a secret readable by","distribution":{"digest":"sha256:c3822668b5c430298ef885009909187152430c0ff43111d4577fea9cfd88c9c2","mediaType":"application/vnd.modiqo.rote-flow","size":50954,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0.json"},"name":"secret-blast-radius","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"Directory tree whose GitHub Actions workflow files should be read for secret blast radius","example":".","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":true,"type":"string"},{"default":"4","description":"How many directory levels below root to search for repositories holding a .github/workflows directory","example":"3","input":{"allowCustom":true,"choices":[],"label":"Depth"},"name":"depth","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/secret-blast-radius@0.3.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-04T04:47:44.290399+00:00","reference":"lgoyal6/secret-blast-radius@0.3.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["bash","python3","find","grep","sed","sort","wc","tr","cat","mktemp","rm"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":3,"names":["analyze","discover","verify"]},"title":"secret-blast-radius","type":"play","version":"0.3.0","visibility":"public"}