v0.1.0

Highlights

• First public release of grackle. A standalone Rust scanner that detects fork-triggerable AI coding agents with repository write access in GitHub Actions and GitLab CI. When an agent runs on untrusted fork input in a job that can write to the repository and nothing checks who triggered it, prompt injection becomes remote code execution and repository takeover under the CI token. grackle finds that exact composition statically, before it merges.
• 36 rules across four evaluation families. Coverage spans named agent actions, roll-your-own LLM agents that POST untrusted issue and PR content to a completions endpoint, secret-exfiltration cases where write access cannot be proven, and GitLab merge-request pipelines with no fork guard. Each rule is self-validated against a built-in positive and negative example.
• Only reports what is exploitable. Every finding proves fork reachability, author and merge gates, and write capability before it fires, so a plain fork pull request that receives no secrets is suppressed rather than flagged.
• Severity and confidence on every finding. Each result carries the offending workflow block, a dynamic secure fix built from the finding's own configuration, and control-framework references across CWE, OWASP, MITRE ATT&CK and ATLAS, NIST, and CIS.
• Pull request and merge request comments. Findings post to GitHub and GitLab with a sticky summary and inline threads that resolve themselves once the issue is fixed.
• Broad output support. SARIF, GitLab SAST, CycloneDX SBOM, JUnit, JSON, HTML, Markdown, YAML, CSV, and XML.
• Signed, reproducible releases. Every archive is Sigstore-signed and carries SLSA Build Level 3 provenance, with a CycloneDX SBOM attached and signed alongside the binaries.