Detection Rules

grackle ships 36 rules covering fork-triggerable AI coding agents that can write to the repository: 32 critical, 4 high. Each rule fires only when a workflow is fork-reachable, has no author gate, and runs the agent in a job that can mutate the repository.

Rules are grouped by how they are post-filtered, not by vendor:

• Installed agents anchor on an agent CLI or action name and confirm the family with a whole-file proof.
• Action-configured agents anchor on an action opened to forks (write sandbox, allowed_non_write_users: "*", and similar).
• Shell-exec secret exposure flags an agent handed an arbitrary shell in a fork-reachable job that carries a secret it could exfiltrate.
• GitLab CI rules use GitLab-native reachability rather than the GitHub on:/permissions: model.