v0.1.3

Highlights

• Catches the action form of claude-code-action, not just CLI agents. The fork-triggerable shell-exec rule now flags workflows that grant anthropics/claude-code-action a shell or file-write tool (Bash, Edit, Write, MultiEdit, NotebookEdit) or an autonomy flag on untrusted issue and pull request content. This is the exact shape behind the Cline compromise, where an agent with only contents: read reached code execution on the runner through its own shell tool. Read and comment-only grants such as Bash(gh pr diff:*) stay clean, and a job with provable repository write remains a single critical finding rather than a double report.
• Whitepaper updates. Added a remediation follow-up showing that 26 percent of the original findings no longer flag on a re-scan weeks later, wrote up the Cline and Hackerbot-Claw incidents as real-world exploitation of the primitive, framed it as the AI-agent variant of poisoned pipeline execution, and added a references section with verified source locators.

Detection coverage otherwise matches 0.1.1. Every archive is Sigstore-signed and carries SLSA Build Level 3 provenance, with a CycloneDX SBOM attached and signed alongside the binaries.

v0.1.2

Highlights

• Catches the action form of claude-code-action, not just CLI agents. The fork-triggerable shell-exec rule now flags workflows that grant anthropics/claude-code-action a shell or file-write tool (Bash, Edit, Write, MultiEdit, NotebookEdit) or an autonomy flag on untrusted issue and pull request content. This is the exact shape behind the Cline compromise, where an agent with only contents: read reached code execution on the runner through its own shell tool. Read and comment-only grants such as Bash(gh pr diff:*) stay clean, and a job with provable repository write remains a single critical finding rather than a double report.
• Whitepaper updates. Added a remediation follow-up showing that 26 percent of the original findings no longer flag on a re-scan weeks later, wrote up the Cline and Hackerbot-Claw incidents as real-world exploitation of the primitive, framed it as the AI-agent variant of poisoned pipeline execution, and added a references section with verified source locators.

Detection coverage otherwise matches 0.1.1. Every archive is Sigstore-signed and carries SLSA Build Level 3 provenance, with a CycloneDX SBOM attached and signed alongside the binaries.

v0.1.1

Highlights

• Fixed the crate page rendering on crates.io. The brand mark and built-with icons now load from absolute URLs and size correctly, instead of resolving against the crate page and failing.

Detection, rules, and outputs are unchanged from 0.1.0. Every archive is Sigstore-signed and carries SLSA Build Level 3 provenance, with a CycloneDX SBOM attached and signed alongside the binaries.

v0.1.0

Highlights

• First public release of grackle. A standalone Rust scanner that detects fork-triggerable AI coding agents with repository write access in GitHub Actions and GitLab CI. When an agent runs on untrusted fork input in a job that can write to the repository and nothing checks who triggered it, prompt injection becomes remote code execution and repository takeover under the CI token. grackle finds that exact composition statically, before it merges.
• 36 rules across four evaluation families. Coverage spans named agent actions, roll-your-own LLM agents that POST untrusted issue and PR content to a completions endpoint, secret-exfiltration cases where write access cannot be proven, and GitLab merge-request pipelines with no fork guard. Each rule is self-validated against a built-in positive and negative example.
• Only reports what is exploitable. Every finding proves fork reachability, author and merge gates, and write capability before it fires, so a plain fork pull request that receives no secrets is suppressed rather than flagged.
• Severity and confidence on every finding. Each result carries the offending workflow block, a dynamic secure fix built from the finding's own configuration, and control-framework references across CWE, OWASP, MITRE ATT&CK and ATLAS, NIST, and CIS.
• Pull request and merge request comments. Findings post to GitHub and GitLab with a sticky summary and inline threads that resolve themselves once the issue is fixed.
• Broad output support. SARIF, GitLab SAST, CycloneDX SBOM, JUnit, JSON, HTML, Markdown, YAML, CSV, and XML.
• Signed, reproducible releases. Every archive is Sigstore-signed and carries SLSA Build Level 3 provenance, with a CycloneDX SBOM attached and signed alongside the binaries.