https://cpeoples.github.io/grackle/rules/index.htmlgrackle ships 36 rules covering fork-triggerable AI coding agents that can write to the repository: 32 critical, 4 high. Each rule fires only when a workflow is fork-reachable, has no author gate, and runs the agent in a job that can mutate the repository. Rules are grouped by how they are post-filtered, not by vendor: Installed agents anchor on an agent CLI or action name and confirm the family with a whole-file proof. Action-configured agents anchor on an action opened to forks (write sandbox, allowed_non_write_users: "*", and similar). Shell-exec secret exposure flags an agent handed an arbitrary shell in a fork-reachable job that carries a secret it could exfiltrate. GitLab CI rules use GitLab-native reachability rather than the GitHub on:/permissions: model.Hugoen-usThu, 23 Jul 2026 14:30:44 +0000https://cpeoples.github.io/grackle/rules/installed/index.htmlThu, 23 Jul 2026 14:30:44 +0000https://cpeoples.github.io/grackle/rules/installed/index.html20 rule(s) in this group. Agent Severity Rule ID Frameworks Aider CRITICAL fork_triggerable_aider_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Amp CRITICAL fork_triggerable_amp_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Bespoke Llm CRITICAL fork_triggerable_bespoke_llm_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Claude Code CLI CRITICAL fork_triggerable_claude_cli_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Codemie CRITICAL fork_triggerable_codemie_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Continue CLI CRITICAL fork_triggerable_continue_cli_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 GitHub Copilot CLI CRITICAL fork_triggerable_copilot_cli_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Crush CRITICAL fork_triggerable_crush_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Cursor CRITICAL fork_triggerable_cursor_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Devin CRITICAL fork_triggerable_devin_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Factory Droid CRITICAL fork_triggerable_droid_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Gemini CLI CRITICAL fork_triggerable_gemini_cli_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Goose CRITICAL fork_triggerable_goose_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 gptme CRITICAL fork_triggerable_gptme_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Kilocode CRITICAL fork_triggerable_kilocode_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 OpenCode CRITICAL fork_triggerable_opencode_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 OpenHands CRITICAL fork_triggerable_openhands_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Qwen Code CRITICAL fork_triggerable_qwen_code_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 SWE-agent CRITICAL fork_triggerable_swe_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Warp CRITICAL fork_triggerable_warp_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11https://cpeoples.github.io/grackle/rules/action/index.htmlThu, 23 Jul 2026 14:30:44 +0000https://cpeoples.github.io/grackle/rules/action/index.html14 rule(s) in this group. Agent Severity Rule ID Frameworks A5C CRITICAL fork_triggerable_a5c_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Generic action write/exec tools CRITICAL fork_triggerable_ai_agent_with_write_or_exec_tools CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Generic action write/exec tools HIGH fork_triggerable_ai_agent_with_repo_mutating_gh_tools CWECWE-77CWE-269CWE-284CWE-1427ATT&CKT1204.001T1195.002T1565.001ATLASAML.T0051AML.T0053AML.T0050OWASP Top 10A01:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6SI-10CISCIS-6.1CIS-16.11 Ai Github Action With Repo Write CRITICAL fork_triggerable_ai_github_action_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Bonk Agent With Write Token CRITICAL fork_triggerable_bonk_agent_with_write_token CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Code CRITICAL fork_triggerable_code_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Codex sandbox CRITICAL fork_triggerable_codex_agent_with_write_or_exec_sandbox CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Cogni CRITICAL fork_triggerable_cogni_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Gemini / Copilot action CRITICAL fork_triggerable_gemini_or_copilot_agent_with_write_or_exec CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Iflow Agent With Prompt CRITICAL fork_triggerable_iflow_agent_with_prompt CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Junie Agent With Prompt Bypass CRITICAL fork_triggerable_junie_agent_with_prompt_bypass CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 Letta Agent Opened To Forks CRITICAL fork_triggerable_letta_agent_opened_to_forks CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11 PR-Agent HIGH fork_triggerable_pr_agent_with_repo_write CWECWE-77CWE-269CWE-284CWE-1427ATT&CKT1204.001T1195.002T1565.001ATLASAML.T0051AML.T0053AML.T0050OWASP Top 10A01:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6SI-10CISCIS-6.1CIS-16.11 Sweep CRITICAL fork_triggerable_sweep_agent_with_repo_write CWECWE-77CWE-94CWE-269CWE-1427ATT&CKT1059T1204.001T1552.001T1195.002ATLASAML.T0051AML.T0051.001AML.T0053AML.T0050OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7SI-10CISCIS-6.1CIS-16.11https://cpeoples.github.io/grackle/rules/shell-exec/index.htmlThu, 23 Jul 2026 14:30:44 +0000https://cpeoples.github.io/grackle/rules/shell-exec/index.html1 rule(s) in this group. Agent Severity Rule ID Frameworks Agent Shell Exec Secret Exposure HIGH fork_triggerable_agent_shell_exec_secret_exposure CWECWE-77CWE-94CWE-522CWE-1427ATT&CKT1059T1552T1552.001T1204.001ATLASAML.T0051AML.T0051.001AML.T0055OWASP Top 10A01:2021A03:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6CM-7IA-5CISCIS-6.1CIS-16.11https://cpeoples.github.io/grackle/rules/gitlab/index.htmlThu, 23 Jul 2026 14:30:44 +0000https://cpeoples.github.io/grackle/rules/gitlab/index.html1 rule(s) in this group. Agent Severity Rule ID Frameworks GitLab CI agent HIGH fork_reachable_gitlab_ci_agent_with_write_or_exec CWECWE-77CWE-269CWE-284CWE-1427ATT&CKT1204.001T1195.002T1565.001ATLASAML.T0051AML.T0053AML.T0050OWASP Top 10A01:2021A08:2021OWASP LLMLLM01LLM02LLM06ASVSV1.2.2V6.2.1NIST 800-53AC-3AC-6SI-10CISCIS-6.1CIS-16.11