# Tools

> Every listed resource, editors’ picks first. The filters below can be combined.

- Search: append `?q=<keywords>` to the URL. Separate several keywords with spaces; all of them must match. Matches name, repository, tags, professions, description and README.
- Filter by type: append `?type=<cli|skill|plugin|mcp>` to the URL.
- Filter by profession: append `?profession=<profession id>` to the URL. Separate several ids with commas; a resource matches when it suits any of them. Ids are listed at https://hebbmind.com/api/v1/professions
- Filter by tag: append `?tag=<tag>` to the URL. Separate several tags with commas; a resource must carry all of them. Tags are listed at https://hebbmind.com/api/v1/tags

Resources for QA or ML / AI or Security, Tagged `github`: 5 items.

> - QA: Functional testing, test automation and quality assurance.
> - ML / AI: Model training, evaluation and LLM application development.
> - Security: Code audits, vulnerability triage, penetration testing and compliance.

- [Code Review](https://hebbmind.com/ru/plugin/code-review.md): [Plugin] Reviews pull requests with several parallel subagents, scores each finding by confidence to filter out false positives, and can post the results as PR comments. Official Anthropic plugin; requires a logged-in GitHub CLI.
- [act](https://hebbmind.com/ru/cli/act.md): [CLI] Runs GitHub Actions workflows locally in Docker, so you can test .github/workflows changes without repeated commits and pushes, or use workflows as a local task runner. Needs Docker installed.
- [TruffleHog](https://hebbmind.com/ru/cli/trufflehog.md): [CLI] Finds leaked credentials in Git, GitHub, S3, filesystems and more, recognizing 800+ secret types and checking with each service whether a key is still live to cut false positives.
- [Agentic Actions Auditor](https://hebbmind.com/ru/skill/agentic-actions-auditor.md): [Skill] Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.
- [zizmor](https://hebbmind.com/ru/cli/zizmor.md): [CLI] Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.