Question: could someone make a GitHub pages website that runs zismor in a dropped yml file and tells if it’s bad in some way?

You’d need to build zizmor for WASM. I’ve thought about doing that work, but I’d happily accept contributions from people towards that who understand WASM better than I do.