grok-build
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the grok CLI using the --always-approve flag. This bypasses interactive permission gates, allowing the delegated tool to perform file modifications and run shell commands autonomously on the local system.
- [REMOTE_CODE_EXECUTION]: By delegating complex implementation tasks to an external agentic CLI with autonomous execution privileges, the skill enables a form of proxy code execution. The delegated agent can perform arbitrary actions on the host machine based on task specifications.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to run grok update, which retrieves and installs software updates from xAI's official distribution channels.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection attack surface where untrusted repository data could influence the behavior of the delegated agent.
- Ingestion points: The agent reads and processes data from the target repository specified in the path (SKILL.md).
- Boundary markers: While instructions are isolated in a temporary task specification file, no markers are used to delimit untrusted repository content from the agent's instructions.
- Capability inventory: The skill utilizes subprocess calls to grok, git, and filesystem management tools (mkdir, New-Item) across SKILL.md and references/cli.md.
- Sanitization: No explicit sanitization, validation, or filtering of the repository data is performed before it is processed by the delegated agent.
Audit Metadata